Email: 739333 Autolearn: 0 AvgScore: 3.74 AvgScanTime: 1.37 sec Spam: 218535 Autolearn: 0 AvgScore: 13.78 AvgScanTime: 1.48 sec Ham: 520798 Autolearn: 0 AvgScore: -0.48 AvgScanTime: 1.33 sec Time Spent Running SA: 282.03 hours Time Spent Processing Spam: 89.85 hours Time Spent Processing Ham: 192.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 208229 91.76 95.28 90.29 2 DKIM_SIGNED 175782 78.47 80.44 77.65 3 DCC_CHECK 173226 52.82 79.27 41.72 4 XM_DK_Pass 170923 77.01 78.21 76.51 5 DKIM_VALID 167010 75.09 76.42 74.53 6 XM_B_Unicode 163149 73.74 74.66 73.35 7 RELAYCOUNTRY_US 162610 81.28 74.41 84.17 8 XMListUnsubscribeExists 148331 57.12 67.88 52.60 9 XM_B_SpammyWords 146788 55.45 67.17 50.54 10 DKIM_VALID_AU 130208 56.89 59.58 55.76 11 XM_DK_Undo_02 95178 18.17 43.55 7.51 12 XM_B_SpammyWords2 84310 27.30 38.58 22.56 13 XM_B_Unicode3 82146 40.71 37.59 42.02 14 BAYES_50 79453 49.83 36.36 55.48 15 HTML_FONT_LOW_CONTRAST 79028 30.41 36.16 28.00 16 TR_XM_DKIM_Undo 77304 14.53 35.37 5.78 17 BAYES_99 73518 13.22 33.64 4.65 18 LOC_TINY_FONT_1 73191 28.00 33.49 25.70 19 MIME_HTML_ONLY 69281 24.29 31.70 21.18 20 RCVD_IN_MSPIKE_H2 60357 27.02 27.62 26.78 21 TR_DCC_Bayes_99 57681 9.52 26.39 2.44 22 DKIM_VALID_EF 57362 27.75 26.25 28.38 23 BAYES_999 56953 10.30 26.06 3.68 24 FVGT_m_MULTI_ODD 55806 24.82 25.54 24.52 25 RELAYCOUNTRY_META 52784 10.64 24.15 4.97 26 T_KAM_HTML_FONT_INVALID 49979 20.15 22.87 19.01 27 XMSubLong 49592 21.67 22.69 21.24 28 T_TM2_M_HEADER_IN_MSG 47447 26.90 21.71 29.08 29 DCC_CHECK_NEGATIVE 41850 45.19 19.15 56.11 30 UNTRUSTED_Relay 40253 6.85 18.42 2.00 31 XM_Multi_Part_URI 39743 13.53 18.19 11.57 32 BOTNET 38894 6.50 17.80 1.77 33 XM_Body_Dirty_Words 36655 14.30 16.77 13.27 34 RCVD_IN_MSPIKE_WL 36547 25.74 16.72 29.52 35 FSL_BULK_SIG 35521 8.69 16.25 5.51 36 LOTS_OF_MONEY 32152 9.74 14.71 7.65 37 XM_B_Unsub 30422 12.07 13.92 11.29 38 BOTNET_IPINHOSTNAME 30378 7.27 13.90 4.49 39 TR_XM_SpammyWords2 30243 4.84 13.84 1.06 40 XM_B_SpammyWords3 26435 7.45 12.10 5.50 41 XM_UncommonTLD01 24741 5.61 11.32 3.22 42 LotsOfNums_01 24635 9.69 11.27 9.03 43 RCVD_IN_MSPIKE_BL 21884 3.42 10.01 0.66 44 XM_B_Phish_Phrases 20739 7.65 9.49 6.88 45 XM_Evil_Numbers_Gen 20683 9.10 9.46 8.95 46 BAYES_80 20597 5.89 9.43 4.41 47 RCVD_IN_MSPIKE_H3 19994 14.33 9.15 16.50 48 XMSexyCombo_05 19479 5.55 8.91 4.14 49 BAYES_60 18028 7.39 8.25 7.03 50 T_REMOTE_IMAGE 17833 4.75 8.16 3.31 51 XM_UB50 17629 3.15 8.07 1.09 52 HTML_IMAGE_RATIO_02 17292 7.13 7.91 6.81 53 XMBrknScrpt_02 17273 3.03 7.90 0.99 54 MPART_ALT_DIFF 16761 6.15 7.67 5.51 55 RCVD_IN_BL_SPAMCOP_NET 16696 3.19 7.64 1.33 56 XMSubMetaSx_00 15626 4.92 7.15 3.99 57 RCVD_IN_MSPIKE_H4 14590 9.25 6.68 10.32 58 KHOP_HELO_FCRDNS 14535 3.05 6.65 1.53 59 HTML_IMAGE_ONLY_12 14002 2.06 6.41 0.24 60 TooManyTo_001 13900 7.77 6.36 8.36 61 MIME_HTML_MOSTLY 13788 3.43 6.31 2.22 62 HTML_SHORT_LINK_IMG_1 13762 1.90 6.30 0.05 63 BODY_URI_ONLY 13669 1.90 6.25 0.07 64 TR_XM_SpammyWords3 13579 2.13 6.21 0.42 65 RCVD_IN_MSPIKE_L3 13264 2.12 6.07 0.46 66 UNPARSEABLE_RELAY 12732 7.78 5.83 8.60 67 XMBody_17 12717 2.35 5.82 0.89 68 BAYES_95 11635 3.37 5.32 2.55 69 XM_H_Long_From01 11310 5.39 5.18 5.48 70 TR_XM_PhishingBody 11154 3.72 5.10 3.14 71 BOTNET_NORDNS 11041 1.51 5.05 0.02 72 HTML_IMAGE_RATIO_04 11031 5.56 5.05 5.78 73 XM_SendGrid 10899 7.02 4.99 7.87 74 RELAYCOUNTRY_CA 10785 2.57 4.94 1.57 75 SpammyFromTLD_02 10420 1.58 4.77 0.24 76 HTML_IMAGE_RATIO_08 10138 3.49 4.64 3.00 77 XM_SPF_SoftFail 9769 2.48 4.47 1.65 78 XM_OfRef6 9741 2.13 4.46 1.15 79 RCVD_IN_RP_SAFE 9471 5.82 4.33 6.44 80 RCVD_IN_RP_RNBL 9382 1.32 4.29 0.07 81 URIBL_SBL_A 8947 1.36 4.09 0.22 82 DKIM_INVALID 8772 3.38 4.01 3.12 83 TR_LOTS_OF_MONEY3 8750 1.68 4.00 0.71 84 T_FONT_INVIS_NAKED_TO 8677 2.38 3.97 1.71 85 XMNumbers 8639 3.38 3.95 3.13 86 XM_B_COVIDMETA 8014 2.05 3.67 1.37 87 RCVD_IN_RP_CERTIFIED 7811 5.32 3.57 6.05 88 SpammyFromTLD_01 7677 1.71 3.51 0.96 89 URI_HEX 7545 1.97 3.45 1.34 90 XM_B_SpammyTLD 7354 2.26 3.37 1.80 91 T_XMDrugObfuBody_08 7344 2.75 3.36 2.50 92 HTML_IMAGE_RATIO_06 7342 4.27 3.36 4.66 93 RELAYCOUNTRY_FR 7287 1.18 3.33 0.28 94 RELAYCOUNTRY_IN 7285 1.06 3.33 0.10 95 XMStrtUSub 7122 4.01 3.26 4.32 96 TM2_M_URI_OPT_OUT 6914 3.08 3.16 3.04 97 TR_XM_MaxSPIKE 6728 0.92 3.08 0.02 98 XM_UB60 6707 0.97 3.07 0.09 99 RCVD_IN_MSPIKE_L5 6300 0.95 2.88 0.14 100 SUBJ_ALL_CAPS 6288 2.00 2.88 1.64 101 XMDiploma_00 6073 2.02 2.78 1.70 102 XM_B_Phish66 5957 2.13 2.73 1.88 103 XM_DIRTYINTL 5887 1.12 2.69 0.46 104 MIME_QP_LONG_LINE 5850 5.07 2.68 6.07 105 HTML_MIME_NO_HTML_TAG 5797 2.19 2.65 1.99 106 TM2_M_VERY_LONG_WORD 5713 1.70 2.61 1.32 107 TR_Mismatch_TLD_02 5661 0.82 2.59 0.07 108 XM_UB99 5651 0.77 2.59 0.00 109 TR_XM_DK_SendGrid 5651 4.14 2.59 4.79 110 URI_TRY_3LD 5585 1.90 2.56 1.63 111 RELAYCOUNTRY_UA 5417 0.74 2.48 0.01 112 BAYES_40 5311 4.06 2.43 4.75 113 DKIM_ADSP_NXDOMAIN 5285 1.06 2.42 0.49 114 LH_URI_DOM_IN_PATH 5219 2.30 2.39 2.27 115 FROM_EXCESS_BASE64 5139 2.74 2.35 2.90 116 RCVD_IN_PSBL 5066 0.73 2.32 0.06 117 XMSexyCombo_01 5047 1.40 2.31 1.02 118 MIME_HTML_ONLY_MULTI 5043 3.09 2.31 3.42 119 XM_UB80 5014 0.70 2.29 0.03 120 T_XMHurry_00 4968 1.60 2.27 1.32 121 PDS_OTHER_BAD_TLD 4935 1.01 2.26 0.49 122 XMSlimDrugH 4907 0.89 2.25 0.32 123 XM_B_SpammyWords4 4906 1.15 2.24 0.69 124 XM_CamelCaseFrm001 4766 1.92 2.18 1.80 125 T_TooManySym_01 4653 3.50 2.13 4.08 126 US_DOLLARS_3 4568 1.07 2.09 0.64 127 HTML_IMAGE_ONLY_24 4453 0.83 2.04 0.32 128 XM_DK_Undo_01 4442 1.75 2.03 1.63 129 XM_B_Unsub2 4412 2.31 2.02 2.43 130 RCVD_IN_IADB_LISTED 4343 4.76 1.99 5.93 131 TR_XM_MaxBayes 4333 0.59 1.98 0.01 132 LOCALPART_IN_SUBJECT 4299 0.60 1.97 0.02 133 TR_Mismatch_TLD_01 4271 0.72 1.95 0.20 134 TO_NAME_SUBJ_NO_RDNS 4268 0.58 1.95 0.00 135 TR_XM_COVIDMETA4 4267 0.83 1.95 0.35 136 INVALID_DATE 4266 0.60 1.95 0.03 137 XMBdyGiftCard01 4263 1.08 1.95 0.72 138 BAYES_20 4239 3.08 1.94 3.56 139 TR_Symld_Words 4140 1.77 1.89 1.71 140 XM_URI_RBL 4073 0.66 1.86 0.16 141 HTML_TAG_BALANCE_BODY 4064 0.96 1.86 0.58 142 HDRS_LCASE_IMGONLY 4047 0.57 1.85 0.03 143 BOGUS_MIME_VERSION 4022 0.54 1.84 0.00 144 TR_XM_SB_Phish 4001 2.04 1.83 2.13 145 HTML_FONT_SIZE_LARGE 3988 0.64 1.82 0.14 146 T_Symld_Words_02 3950 0.91 1.81 0.53 147 FROM_SUSPICIOUS_NTLD 3913 0.59 1.79 0.09 148 XMSubPhish11 3878 2.00 1.77 2.09 149 XMGenDplmaNmb 3790 1.20 1.73 0.98 150 LongTLD 3758 0.64 1.72 0.18 151 RCVD_IN_IADB_SPF 3744 4.19 1.71 5.22 152 BAYES_00 3726 11.24 1.70 15.24 153 FROM_SUSPICIOUS_NTLD_FP 3716 0.56 1.70 0.08 154 T_XMDrugObfuBody_14 3711 1.77 1.70 1.80 155 TR_XM_UnparsRelay 3532 0.72 1.62 0.34 156 RCVD_IN_IADB_DK 3494 3.68 1.60 4.56 157 RCVD_IN_IADB_SENDERID 3492 3.78 1.60 4.70 158 XM_UB999 3484 0.47 1.59 0.00 159 XMSubMetaSxObfu_03 3434 1.05 1.57 0.84 160 T_FILL_THIS_FORM_SHORT 3281 1.14 1.50 1.00 161 MAILING_LIST_MULTI 3247 2.21 1.49 2.52 162 XMStockSpam_06 3159 1.50 1.45 1.53 163 TVD_SPACE_RATIO 3034 0.66 1.39 0.35 164 RELAYCOUNTRY_GB 2979 1.12 1.36 1.01 165 PDS_FROM_2_EMAILS 2907 0.41 1.33 0.03 166 TR_XM_PHPDW 2891 0.60 1.32 0.30 167 TR_XM_PHPForged 2870 0.58 1.31 0.27 168 TR_XM_COVIDMETA1 2865 0.62 1.31 0.33 169 FROM_2_EMAILS_SHORT 2848 0.39 1.30 0.00 170 TR_Caps_n_Bayes_99 2846 0.42 1.30 0.06 171 TR_XM_FormFill2 2823 0.57 1.29 0.27 172 XM_H_PHPOS 2820 0.57 1.29 0.27 173 T_XMDrugObfuBody_00 2765 0.85 1.27 0.68 174 DATE_IN_PAST_03_06 2753 0.43 1.26 0.09 175 DIET_1 2724 0.63 1.25 0.38 176 PDS_TO_EQ_FROM_NAME 2709 0.37 1.24 0.01 177 DKIM_ADSP_CUSTOM_MED 2657 1.11 1.22 1.06 178 XM_UB95 2654 0.37 1.21 0.01 179 XMHTML_After_End 2651 1.13 1.21 1.10 180 XMSubMetaI_00 2605 0.89 1.19 0.77 181 TR_XM_RelayPhish 2582 0.43 1.18 0.11 182 URI_NOVOWEL 2543 2.20 1.16 2.64 183 TVD_SPACE_RATIO_MINFP 2517 0.35 1.15 0.01 184 TR_XM_INV_DKIM 2510 0.40 1.15 0.09 185 HTML_IMAGE_ONLY_28 2499 0.63 1.14 0.41 186 LONG_JUNK_URI 2497 0.36 1.14 0.04 187 NO_FM_NAME_IP_HOSTN 2433 0.33 1.11 0.00 188 NML_ADSP_CUSTOM_MED 2407 0.84 1.10 0.73 189 XMMoneyMeta_00 2337 0.68 1.07 0.52 190 XM_PDF 2317 3.25 1.06 4.16 191 URIBL_BLACK 2262 0.33 1.04 0.03 192 XM_ProductURIs 2193 1.13 1.00 1.18 193 FORGED_GMAIL_RCVD 2164 0.72 0.99 0.61 194 SUBJ_DOLLARS 2125 0.64 0.97 0.50 195 RCVD_IN_IADB_VOUCHED 2099 2.77 0.96 3.52 196 XM_OfRef7 2037 0.36 0.93 0.12 197 TR_XM_FormFill 2031 0.29 0.93 0.02 198 XM_RXBody 2008 0.66 0.92 0.55 199 BAYES_05 1999 1.91 0.91 2.32 200 RDNS_DYNAMIC 1995 0.60 0.91 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 470215 91.76 95.28 90.29 2 RELAYCOUNTRY_US 438335 81.28 74.41 84.17 3 DKIM_SIGNED 404383 78.47 80.44 77.65 4 XM_DK_Pass 398442 77.01 78.21 76.51 5 DKIM_VALID 388130 75.09 76.42 74.53 6 XM_B_Unicode 382014 73.74 74.66 73.35 7 DCC_CHECK_NEGATIVE 292220 45.19 19.15 56.11 8 DKIM_VALID_AU 290408 56.89 59.58 55.76 9 BAYES_50 288923 49.83 36.36 55.48 10 XMListUnsubscribeExists 273947 57.12 67.88 52.60 11 XM_B_SpammyWords 263191 55.45 67.17 50.54 12 XM_B_Unicode3 218834 40.71 37.59 42.02 13 DCC_CHECK 217299 52.82 79.27 41.72 14 RCVD_IN_MSPIKE_WL 153753 25.74 16.72 29.52 15 T_TM2_M_HEADER_IN_MSG 151430 26.90 21.71 29.08 16 DKIM_VALID_EF 147808 27.75 26.25 28.38 17 HTML_FONT_LOW_CONTRAST 145825 30.41 36.16 28.00 18 RCVD_IN_MSPIKE_H2 139445 27.02 27.62 26.78 19 LOC_TINY_FONT_1 133841 28.00 33.49 25.70 20 FVGT_m_MULTI_ODD 127678 24.82 25.54 24.52 21 XM_B_SpammyWords2 117517 27.30 38.58 22.56 22 XMSubLong 110637 21.67 22.69 21.24 23 MIME_HTML_ONLY 110316 24.29 31.70 21.18 24 T_KAM_HTML_FONT_INVALID 99013 20.15 22.87 19.01 25 RCVD_IN_MSPIKE_H3 85957 14.33 9.15 16.50 26 BAYES_00 79368 11.24 1.70 15.24 27 XM_Body_Dirty_Words 69086 14.30 16.77 13.27 28 ALL_TRUSTED 62750 8.75 0.87 12.05 29 XM_Multi_Part_URI 60257 13.53 18.19 11.57 30 XM_B_Unsub 58813 12.07 13.92 11.29 31 TR_XM_DK_Bayes 55005 7.68 0.82 10.56 32 RCVD_IN_MSPIKE_H4 53768 9.25 6.68 10.32 33 TR_XM_DK_Bayes1 53500 7.47 0.81 10.27 34 XM_DKIMWhitelistDomains 48353 6.56 0.07 9.28 35 TR_XM_DK_Bayes2 47557 6.65 0.73 9.13 36 LotsOfNums_01 47037 9.69 11.27 9.03 37 XM_Evil_Numbers_Gen 46599 9.10 9.46 8.95 38 UNPARSEABLE_RELAY 44777 7.78 5.83 8.60 39 TooManyTo_001 43542 7.77 6.36 8.36 40 XM_SendGrid 41002 7.02 4.99 7.87 41 LOTS_OF_MONEY 39829 9.74 14.71 7.65 42 XM_DK_Undo_02 39130 18.17 43.55 7.51 43 BAYES_60 36619 7.39 8.25 7.03 44 XM_B_Phish_Phrases 35836 7.65 9.49 6.88 45 HTML_IMAGE_RATIO_02 35450 7.13 7.91 6.81 46 RCVD_IN_RP_SAFE 33529 5.82 4.33 6.44 47 IN_ZIMBRA_NJ_WHITELIST 32706 4.44 0.07 6.28 48 MIME_QP_LONG_LINE 31614 5.07 2.68 6.07 49 RCVD_IN_RP_CERTIFIED 31516 5.32 3.57 6.05 50 RCVD_IN_IADB_LISTED 30865 4.76 1.99 5.93 51 TR_XM_DKIM_Undo 30098 14.53 35.37 5.78 52 HTML_IMAGE_RATIO_04 30086 5.56 5.05 5.78 53 FSL_BULK_SIG 28693 8.69 16.25 5.51 54 MPART_ALT_DIFF 28673 6.15 7.67 5.51 55 XM_B_SpammyWords3 28667 7.45 12.10 5.50 56 XM_H_Long_From01 28526 5.39 5.18 5.48 57 RCVD_IN_IADB_SPF 27210 4.19 1.71 5.22 58 RELAYCOUNTRY_META 25890 10.64 24.15 4.97 59 TR_XM_DK_SendGrid 24972 4.14 2.59 4.79 60 BAYES_40 24734 4.06 2.43 4.75 61 RCVD_IN_IADB_SENDERID 24456 3.78 1.60 4.70 62 HTML_IMAGE_RATIO_06 24255 4.27 3.36 4.66 63 BAYES_99 24222 13.22 33.64 4.65 64 RCVD_IN_IADB_DK 23748 3.68 1.60 4.56 65 BOTNET_IPINHOSTNAME 23399 7.27 13.90 4.49 66 BAYES_80 22986 5.89 9.43 4.41 67 XMStrtUSub 22495 4.01 3.26 4.32 68 XM_PDF 21691 3.25 1.06 4.16 69 XMSexyCombo_05 21548 5.55 8.91 4.14 70 T_TooManySym_01 21239 3.50 2.13 4.08 71 XMSubMetaSx_00 20778 4.92 7.15 3.99 72 BAYES_999 19164 10.30 26.06 3.68 73 BAYES_20 18546 3.08 1.94 3.56 74 RCVD_IN_IADB_VOUCHED 18353 2.77 0.96 3.52 75 MIME_HTML_ONLY_MULTI 17814 3.09 2.31 3.42 76 T_REMOTE_IMAGE 17259 4.75 8.16 3.31 77 XM_UncommonTLD01 16761 5.61 11.32 3.22 78 TR_XM_PhishingBody 16332 3.72 5.10 3.14 79 XMNumbers 16322 3.38 3.95 3.13 80 DKIM_INVALID 16253 3.38 4.01 3.12 81 TM2_M_URI_OPT_OUT 15843 3.08 3.16 3.04 82 HTML_IMAGE_RATIO_08 15643 3.49 4.64 3.00 83 XM_H_Trusted_IP 15285 2.07 0.00 2.93 84 FROM_EXCESS_BASE64 15089 2.74 2.35 2.90 85 RCVD_IN_MSPIKE_H5 14028 2.16 0.90 2.69 86 URI_NOVOWEL 13758 2.20 1.16 2.64 87 BAYES_95 13270 3.37 5.32 2.55 88 ANY_BOUNCE_MESSAGE 13249 1.92 0.44 2.54 89 BOUNCE_MESSAGE 13249 1.92 0.44 2.54 90 MAILING_LIST_MULTI 13109 2.21 1.49 2.52 91 T_XMDrugObfuBody_08 13013 2.75 3.36 2.50 92 TR_DCC_Bayes_99 12696 9.52 26.39 2.44 93 XM_B_Unsub2 12661 2.31 2.02 2.43 94 BAYES_05 12099 1.91 0.91 2.32 95 LH_URI_DOM_IN_PATH 11816 2.30 2.39 2.27 96 RCVD_IN_IADB_OPTIN 11593 1.77 0.67 2.23 97 MIME_HTML_MOSTLY 11543 3.43 6.31 2.22 98 TR_XM_SB_Phish 11091 2.04 1.83 2.13 99 XMSubPhish11 10891 2.00 1.77 2.09 100 T_TooManySym_02 10686 1.58 0.46 2.05 101 TooManyTo_002 10639 1.64 0.67 2.04 102 UNTRUSTED_Relay 10399 6.85 18.42 2.00 103 HTML_MIME_NO_HTML_TAG 10366 2.19 2.65 1.99 104 XM_B_Phish66 9796 2.13 2.73 1.88 105 XM_CamelCaseFrm001 9397 1.92 2.18 1.80 106 XM_B_SpammyTLD 9387 2.26 3.37 1.80 107 T_XMDrugObfuBody_14 9382 1.77 1.70 1.80 108 BOTNET 9198 6.50 17.80 1.77 109 HELO_NODOT 9126 1.43 0.65 1.75 110 HELO_NO_DOMAIN 9123 1.43 0.65 1.75 111 TR_Symld_Words 8918 1.77 1.89 1.71 112 T_FONT_INVIS_NAKED_TO 8896 2.38 3.97 1.71 113 XMDiploma_00 8858 2.02 2.78 1.70 114 XM_SPF_SoftFail 8568 2.48 4.47 1.65 115 SUBJ_ALL_CAPS 8524 2.00 2.88 1.64 116 URI_TRY_3LD 8464 1.90 2.56 1.63 117 XM_DK_Undo_01 8463 1.75 2.03 1.63 118 IN_HORDE_ADDRESS_BOOK 8248 1.20 0.28 1.58 119 RELAYCOUNTRY_CA 8200 2.57 4.94 1.57 120 KHOP_HELO_FCRDNS 7979 3.05 6.65 1.53 121 XMStockSpam_06 7957 1.50 1.45 1.53 122 XMBody_95 7326 1.03 0.13 1.41 123 INVALID_MSGID 7270 1.08 0.31 1.40 124 TVD_RCVD_IP 7184 1.03 0.21 1.38 125 XM_B_COVIDMETA 7131 2.05 3.67 1.37 126 TooManyTo_003 7017 1.11 0.54 1.35 127 URI_HEX 7003 1.97 3.45 1.34 128 RCVD_IN_BL_SPAMCOP_NET 6919 3.19 7.64 1.33 129 T_XMHurry_00 6886 1.60 2.27 1.32 130 TM2_M_VERY_LONG_WORD 6851 1.70 2.61 1.32 131 XM_H_Long_From02 6793 1.18 0.90 1.30 132 TR_MSPIKEBAYES00 6447 0.88 0.03 1.24 133 TO_MALFORMED 6435 0.89 0.06 1.24 134 XMCapTrack 6229 0.93 0.30 1.20 135 XM_ProductURIs 6146 1.13 1.00 1.18 136 XM_OfRef6 6006 2.13 4.46 1.15 137 XMGappySubj_01 5924 0.85 0.16 1.14 138 USER_IN_DEF_DKIM_WL 5911 0.80 0.01 1.13 139 HELO_MISC_IP 5891 0.90 0.34 1.13 140 CK_HELO_DYNAMIC_SPLIT_IP 5883 0.93 0.47 1.13 141 XMHTML_After_End 5735 1.13 1.21 1.10 142 XMSubNoVowel 5724 1.04 0.90 1.10 143 XM_UB50 5695 3.15 8.07 1.09 144 HTML_FONT_FACE_BAD 5647 0.94 0.60 1.08 145 DKIM_ADSP_CUSTOM_MED 5542 1.11 1.22 1.06 146 TR_XM_SpammyWords2 5535 4.84 13.84 1.06 147 XM_GoogleGroups 5353 0.86 0.46 1.03 148 XMSexyCombo_01 5301 1.40 2.31 1.02 149 RELAYCOUNTRY_GB 5284 1.12 1.36 1.01 150 TR_LOTS_OF_MONEY2 5223 0.96 0.85 1.00 151 T_MONEY_PERCENT 5223 0.96 0.85 1.00 152 T_FILL_THIS_FORM_SHORT 5182 1.14 1.50 1.00 153 TooManyTo_004 5157 0.84 0.49 0.99 154 XMBrknScrpt_02 5152 3.03 7.90 0.99 155 XMGenDplmaNmb 5086 1.20 1.73 0.98 156 SpammyFromTLD_01 4994 1.71 3.51 0.96 157 XMBSHREFv2 4878 0.75 0.30 0.94 158 XMBody_17 4661 2.35 5.82 0.89 159 XM_ShortIntro_01 4523 0.76 0.51 0.87 160 XMSubMetaSxObfu_03 4352 1.05 1.57 0.84 161 T_TooManySym_03 4233 0.62 0.16 0.81 162 TooManyTo_005 4156 0.68 0.41 0.80 163 XMSubMetaI_00 4002 0.89 1.19 0.77 164 TM2_M_A_HREF_HREF 3898 0.73 0.69 0.75 165 NML_ADSP_CUSTOM_MED 3811 0.84 1.10 0.73 166 XMBdyGiftCard01 3728 1.08 1.95 0.72 167 TR_LOTS_OF_MONEY3 3699 1.68 4.00 0.71 168 HTTPS_HTTP_MISMATCH 3644 0.71 0.74 0.70 169 XM_B_SpammyWords4 3612 1.15 2.24 0.69 170 T_XMDrugObfuBody_00 3556 0.85 1.27 0.68 171 XM_H_PHPMailer 3445 0.58 0.39 0.66 172 RCVD_IN_MSPIKE_BL 3424 3.42 10.01 0.66 173 XM_SPF_Unknown 3424 0.71 0.85 0.66 174 TR_MetaPhish_Combo_01 3422 0.70 0.80 0.66 175 US_DOLLARS_3 3348 1.07 2.09 0.64 176 XMHTMLBadTable_001 3203 0.64 0.69 0.62 177 FORGED_GMAIL_RCVD 3187 0.72 0.99 0.61 178 FROM_GOV_DKIM_AU 3123 0.44 0.06 0.60 179 T_OBFU_PDF_ATTACH 3070 0.46 0.15 0.59 180 HTML_TAG_BALANCE_BODY 3010 0.96 1.86 0.58 181 XMSexyCombo_04 2888 0.60 0.69 0.55 182 XM_RXBody 2848 0.66 0.92 0.55 183 T_Symld_Words_02 2769 0.91 1.81 0.53 184 XMMoneyMeta_00 2686 0.68 1.07 0.52 185 XMNoVowels 2660 0.45 0.30 0.51 186 HTML_IMAGE_ONLY_20 2644 0.45 0.33 0.51 187 SUBJ_DOLLARS 2618 0.64 0.97 0.50 188 SHORT_HELO_AND_INLINE_IMAGE 2596 0.37 0.08 0.50 189 RCVD_IN_SORBS_DUL 2580 0.48 0.43 0.50 190 RELAYCOUNTRY_DE 2574 0.50 0.50 0.49 191 DKIM_ADSP_NXDOMAIN 2561 1.06 2.42 0.49 192 PDS_OTHER_BAD_TLD 2542 1.01 2.26 0.49 193 NO_DNS_FOR_FROM 2541 0.48 0.48 0.49 194 XMSolicitRefs_0 2522 0.44 0.34 0.48 195 T_TooManySym_04 2498 0.35 0.05 0.48 196 RDNS_DYNAMIC 2439 0.60 0.91 0.47 197 XM_DIRTYINTL 2418 1.12 2.69 0.46 198 RCVD_IN_MSPIKE_L3 2412 2.12 6.07 0.46 199 LOW_PRICE 2390 0.47 0.48 0.46 200 MISSING_HEADERS 2353 0.48 0.55 0.45 ----------------------------------------------------------------------