Email: 461926 Autolearn: 0 AvgScore: 5.01 AvgScanTime: 1.19 sec Spam: 196740 Autolearn: 0 AvgScore: 13.18 AvgScanTime: 1.15 sec Ham: 265186 Autolearn: 0 AvgScore: -1.04 AvgScanTime: 1.22 sec Time Spent Running SA: 152.81 hours Time Spent Processing Spam: 62.60 hours Time Spent Processing Ham: 90.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 185724 89.01 94.40 85.02 2 DKIM_SIGNED 156484 79.93 79.54 80.23 3 XM_DK_Pass 153564 78.78 78.05 79.31 4 DKIM_VALID 152139 77.66 77.33 77.91 5 DCC_CHECK 137364 56.98 69.82 47.45 6 RELAYCOUNTRY_US 137027 77.49 69.65 83.30 7 DKIM_VALID_AU 131614 64.90 66.90 63.41 8 XM_B_SpammyWords 121557 56.55 61.79 52.66 9 XM_B_Unicode 101129 63.10 51.40 71.77 10 XMListUnsubscribeExists 94926 52.02 48.25 54.81 11 RCVD_IN_MSPIKE_H2 74056 32.00 37.64 27.82 12 MIME_HTML_ONLY 72743 29.14 36.97 23.32 13 XM_DK_Undo_02 71279 20.62 36.23 9.03 14 BAYES_50 69350 45.38 35.25 52.90 15 RELAYCOUNTRY_META 59279 15.61 30.13 4.83 16 BAYES_99 58557 16.45 29.76 6.57 17 DCC_CHECK_NEGATIVE 57702 41.98 29.33 51.37 18 XM_B_SpammyWords2 55051 25.76 27.98 24.10 19 TR_XM_DKIM_Undo 54156 15.70 27.53 6.93 20 HTML_FONT_LOW_CONTRAST 52277 29.70 26.57 32.02 21 LOTS_OF_MONEY 51351 15.81 26.10 8.18 22 T_TM2_M_HEADER_IN_MSG 49756 23.69 25.29 22.51 23 XM_B_Unicode3 48619 35.76 24.71 43.96 24 LOC_TINY_FONT_1 48177 28.03 24.49 30.66 25 XMSubEmpty 47353 10.35 24.07 0.18 26 UNTRUSTED_Relay 47220 11.58 24.00 2.36 27 FSL_BULK_SIG 46295 13.26 23.53 5.64 28 HTML_MIME_NO_HTML_TAG 45139 10.54 22.94 1.33 29 BAYES_999 44728 12.57 22.73 5.03 30 TR_Sbj_FN_Bdy 43929 9.59 22.33 0.15 31 XMNoSubject 43691 9.50 22.21 0.08 32 MISSING_SUBJECT 43691 9.50 22.21 0.08 33 TR_DCC_Bayes_99 43480 11.75 22.10 4.07 34 DKIM_VALID_EF 39763 27.27 20.21 32.51 35 TR_LOTS_OF_MONEY3 39226 9.18 19.94 1.20 36 XMBody_17 37093 8.66 18.85 1.10 37 FVGT_m_MULTI_ODD 32302 19.86 16.42 22.41 38 XM_Multi_Part_URI 28693 14.14 14.58 13.82 39 T_KAM_HTML_FONT_INVALID 28143 15.85 14.30 16.99 40 XM_UB50 28100 6.75 14.28 1.16 41 HELO_NO_DOMAIN 26875 6.25 13.66 0.75 42 HELO_NODOT 26875 6.25 13.66 0.75 43 MISSING_HEADERS 26675 6.06 13.56 0.50 44 REPLYTO_WITHOUT_TO_CC 26502 5.76 13.47 0.03 45 TR_LOTS_OF_MONEY1 26487 5.84 13.46 0.19 46 SUBJ_ALL_CAPS 26348 6.66 13.39 1.67 47 BAYES_80 26169 8.95 13.30 5.73 48 XMSubLong 25174 17.63 12.80 21.22 49 XM_Body_Dirty_Words 23985 13.37 12.19 14.25 50 TR_XM_SpammyWords2 23242 5.99 11.81 1.67 51 DEAR_SOMETHING 23055 5.14 11.72 0.26 52 MILLION_USD 23013 4.99 11.70 0.01 53 RCVD_IN_MSPIKE_WL 21539 22.50 10.95 31.07 54 RELAYCOUNTRY_KE 20701 4.48 10.52 0.00 55 BOTNET 20593 5.40 10.47 1.64 56 TR_Orig_Subnet 20518 4.45 10.43 0.01 57 MONEY_FROM_41 20486 4.43 10.41 0.00 58 BAYES_60 19740 9.28 10.03 8.73 59 XM_UncommonTLD01 18727 6.25 9.52 3.83 60 XM_B_SpammyWords3 18416 7.60 9.36 6.30 61 XM_B_Unsub 17774 10.07 9.03 10.84 62 LotsOfNums_01 17576 8.31 8.93 7.84 63 RCVD_IN_MSPIKE_BL 16586 4.02 8.43 0.76 64 BOTNET_IPINHOSTNAME 15533 6.54 7.90 5.54 65 XMSexyCombo_05 14158 6.15 7.20 5.37 66 MPART_ALT_DIFF 14009 6.31 7.12 5.71 67 RCVD_IN_BL_SPAMCOP_NET 12207 3.32 6.20 1.18 68 MIME_HTML_MOSTLY 12127 4.39 6.16 3.07 69 BAYES_95 11961 4.94 6.08 4.09 70 XMSubMetaSx_00 11582 4.84 5.89 4.07 71 RCVD_IN_MSPIKE_H3 11416 11.82 5.80 16.28 72 HTML_IMAGE_RATIO_02 11324 7.67 5.76 9.09 73 XM_Evil_Numbers_Gen 11058 7.27 5.62 8.50 74 RCVD_IN_MSPIKE_L3 10258 2.59 5.21 0.65 75 TR_XM_SpammyWords3 10092 2.48 5.13 0.52 76 RELAYCOUNTRY_CA 10021 3.35 5.09 2.05 77 TooManyTo_001 9771 5.97 4.97 6.71 78 XMBrknScrpt_02 9621 2.70 4.89 1.08 79 XM_B_Phish_Phrases 9370 7.55 4.76 9.62 80 RCVD_IN_MSPIKE_H4 9204 8.76 4.68 11.80 81 TR_XM_PhishingBody 8798 3.74 4.47 3.20 82 XM_B_SpammyTLD 8777 3.24 4.46 2.34 83 SpammyFromTLD_01 8625 2.16 4.38 0.52 84 RCVD_IN_RP_SAFE 7928 8.54 4.03 11.88 85 RELAYCOUNTRY_FR 7410 1.73 3.77 0.22 86 UNPARSEABLE_RELAY 7094 6.87 3.61 9.30 87 URIBL_SBL_A 7065 1.67 3.59 0.25 88 XM_UB60 7040 1.58 3.58 0.09 89 RCVD_IN_RP_CERTIFIED 6583 7.76 3.35 11.03 90 HTML_IMAGE_RATIO_04 6323 5.00 3.21 6.33 91 XM_H_Long_From01 5933 4.19 3.02 5.07 92 SpammyFromTLD_02 5902 1.36 3.00 0.14 93 XM_B_Phish66 5830 1.93 2.96 1.16 94 XMStrtUSub 5760 6.00 2.93 8.28 95 XM_OfRef6 5508 1.93 2.80 1.29 96 TR_XM_MaxSPIKE 5490 1.21 2.79 0.03 97 XM_UB99 5456 1.18 2.77 0.00 98 RELAYCOUNTRY_IN 5259 1.17 2.67 0.06 99 T_XMDrugObfuBody_08 5238 1.99 2.66 1.49 100 URI_HEX 5186 1.87 2.64 1.29 101 XMSubNoVowel 5169 1.87 2.63 1.31 102 BAYES_40 5142 3.37 2.61 3.94 103 HTML_IMAGE_RATIO_06 5101 3.05 2.59 3.38 104 T_FONT_INVIS_NAKED_TO 5085 2.33 2.58 2.14 105 HTML_IMAGE_RATIO_08 4992 2.29 2.54 2.10 106 XM_SendGrid 4922 5.89 2.50 8.41 107 RCVD_IN_RP_RNBL 4858 1.09 2.47 0.06 108 XM_DIRTYINTL 4785 1.30 2.43 0.46 109 XMNumbers 4599 3.27 2.34 3.96 110 TR_XM_MaxBayes 4438 0.97 2.26 0.01 111 RELAYCOUNTRY_SG 4424 0.99 2.25 0.06 112 DKIM_INVALID 4345 2.27 2.21 2.32 113 T_XMHurry_00 4036 1.31 2.05 0.76 114 BODY_URI_ONLY 3835 0.86 1.95 0.05 115 XM_UB999 3824 0.83 1.94 0.00 116 XM_SPF_SoftFail 3793 1.40 1.93 1.00 117 URI_TRY_3LD 3724 1.56 1.89 1.32 118 TM2_M_URI_OPT_OUT 3695 3.14 1.88 4.07 119 BOTNET_NORDNS 3651 0.80 1.86 0.01 120 DEAR_BENEFICIARY 3616 0.95 1.84 0.29 121 RCVD_IN_PSBL 3449 0.79 1.75 0.07 122 T_REMOTE_IMAGE 3431 2.30 1.74 2.72 123 BAYES_20 3317 2.46 1.69 3.04 124 RCVD_IN_MSPIKE_L5 3280 0.75 1.67 0.08 125 TM2_M_VERY_LONG_WORD 3254 1.35 1.65 1.13 126 LH_URI_DOM_IN_PATH 3244 1.50 1.65 1.39 127 FROM_EXCESS_BASE64 3190 2.90 1.62 3.85 128 XM_UB80 3100 0.69 1.58 0.03 129 XMBdyGiftCard01 2911 1.48 1.48 1.48 130 KHOP_HELO_FCRDNS 2875 1.27 1.46 1.13 131 XMDiploma_00 2786 1.37 1.42 1.34 132 XM_CamelCaseFrm001 2774 1.72 1.41 1.94 133 XM_B_SpammyWords4 2759 1.04 1.40 0.78 134 XMSexyCombo_01 2746 1.28 1.40 1.19 135 TR_XM_DK_SendGrid 2723 3.58 1.38 5.21 136 T_FILL_THIS_FORM_SHORT 2711 1.03 1.38 0.78 137 RCVD_IN_MSPIKE_ZBI 2512 0.55 1.28 0.00 138 MIME_HTML_ONLY_MULTI 2446 2.56 1.24 3.54 139 T_TooManySym_01 2339 4.18 1.19 6.39 140 TR_XM_UnparsRelay 2317 0.77 1.18 0.47 141 TR_Mismatch_TLD_01 2238 0.74 1.14 0.45 142 PDS_OTHER_BAD_TLD 2189 0.97 1.11 0.87 143 DATE_IN_PAST_03_06 2101 0.49 1.07 0.07 144 TR_Caps_n_Bayes_99 2098 0.51 1.07 0.10 145 TR_XM_PHPDW 2037 0.63 1.04 0.32 146 TR_XM_PHPForged 2000 0.59 1.02 0.27 147 TR_XM_FormFill2 1992 0.59 1.01 0.27 148 XM_H_PHPOS 1992 0.58 1.01 0.26 149 XM_B_COVIDMETA 1966 0.77 1.00 0.59 150 XMClaimOffer 1917 0.50 0.97 0.14 151 XM_B_Unsub2 1886 0.91 0.96 0.87 152 RELAYCOUNTRY_DE 1871 0.59 0.95 0.32 153 TR_Symld_Words 1857 1.60 0.94 2.08 154 XM_UB95 1798 0.40 0.91 0.02 155 XMStockSpam_06 1725 1.28 0.88 1.57 156 MIME_QP_LONG_LINE 1704 2.52 0.87 3.74 157 ANY_BOUNCE_MESSAGE 1690 1.85 0.86 2.59 158 BOUNCE_MESSAGE 1690 1.85 0.86 2.59 159 TR_XM_FormFill 1672 0.37 0.85 0.01 160 XMSubMetaSxObfu_03 1660 0.59 0.84 0.40 161 RCVD_IN_IADB_LISTED 1630 2.42 0.83 3.60 162 TR_XM_SB_Phish 1605 1.16 0.82 1.42 163 XM_DK_Undo_01 1605 1.21 0.82 1.49 164 XMGppyBdWords 1598 0.41 0.81 0.12 165 RELAYCOUNTRY_NL 1597 0.51 0.81 0.29 166 RELAYCOUNTRY_GB 1580 0.70 0.80 0.62 167 XM_ShortIntro_01 1580 0.96 0.80 1.08 168 TR_XM_INV_DKIM 1533 0.37 0.78 0.07 169 ALL_TRUSTED 1525 7.35 0.78 12.22 170 XM_URI_RBL 1478 0.44 0.75 0.22 171 XMSubPhish11 1467 1.13 0.75 1.41 172 XMGenDplmaNmb 1465 0.76 0.74 0.78 173 T_XMDrugObfuBody_00 1434 0.73 0.73 0.72 174 T_XMDrugObfuBody_14 1429 1.35 0.73 1.81 175 RCVD_IN_IADB_SPF 1420 2.12 0.72 3.16 176 TR_XM_COVIDMETA4 1413 0.41 0.72 0.18 177 MAILING_LIST_MULTI 1413 1.61 0.72 2.27 178 TR_XM_RelayPhish 1402 0.35 0.71 0.09 179 HTTPS_HTTP_MISMATCH 1400 0.61 0.71 0.54 180 URI_NOVOWEL 1398 1.43 0.71 1.97 181 BAYES_05 1396 1.45 0.71 2.00 182 FROM_SUSPICIOUS_NTLD 1383 0.36 0.70 0.10 183 MIME_CHARSET_FARAWAY 1377 0.37 0.70 0.12 184 TR_Mismatch_TLD_02 1351 0.33 0.69 0.07 185 HTML_IMAGE_ONLY_12 1346 0.36 0.68 0.12 186 RCVD_IN_IADB_DK 1325 1.86 0.67 2.74 187 XM_ProductURIs 1322 1.21 0.67 1.60 188 FROM_SUSPICIOUS_NTLD_FP 1317 0.34 0.67 0.09 189 HK_RANDOM_REPLYTO 1313 0.38 0.67 0.17 190 XMLngstWrd_00 1304 0.55 0.66 0.46 191 XMLngstWrd_01 1282 0.52 0.65 0.41 192 XMHTML_After_End 1280 0.65 0.65 0.64 193 RCVD_IN_IADB_SENDERID 1280 1.90 0.65 2.83 194 HTML_TAG_BALANCE_BODY 1263 0.79 0.64 0.90 195 XMBody_78 1258 0.53 0.64 0.45 196 XM_Lotto 1256 0.48 0.64 0.37 197 RDNS_DYNAMIC 1239 0.70 0.63 0.75 198 XM_BadFromFormat 1235 0.40 0.63 0.23 199 URI_NO_WWW_INFO_CGI 1221 0.27 0.62 0.02 200 CHARSET_FARAWAY_HEADER 1219 0.30 0.62 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 225451 89.01 94.40 85.02 2 RELAYCOUNTRY_US 220909 77.49 69.65 83.30 3 DKIM_SIGNED 212755 79.93 79.54 80.23 4 XM_DK_Pass 210330 78.78 78.05 79.31 5 DKIM_VALID 206602 77.66 77.33 77.91 6 XM_B_Unicode 190331 63.10 51.40 71.77 7 DKIM_VALID_AU 168163 64.90 66.90 63.41 8 XMListUnsubscribeExists 145357 52.02 48.25 54.81 9 BAYES_50 140278 45.38 35.25 52.90 10 XM_B_SpammyWords 139654 56.55 61.79 52.66 11 DCC_CHECK_NEGATIVE 136230 41.98 29.33 51.37 12 DCC_CHECK 125819 56.98 69.82 47.45 13 XM_B_Unicode3 116568 35.76 24.71 43.96 14 DKIM_VALID_EF 86203 27.27 20.21 32.51 15 HTML_FONT_LOW_CONTRAST 84917 29.70 26.57 32.02 16 RCVD_IN_MSPIKE_WL 82387 22.50 10.95 31.07 17 LOC_TINY_FONT_1 81293 28.03 24.49 30.66 18 RCVD_IN_MSPIKE_H2 73779 32.00 37.64 27.82 19 XM_B_SpammyWords2 63919 25.76 27.98 24.10 20 MIME_HTML_ONLY 61849 29.14 36.97 23.32 21 T_TM2_M_HEADER_IN_MSG 59696 23.69 25.29 22.51 22 FVGT_m_MULTI_ODD 59426 19.86 16.42 22.41 23 XMSubLong 56270 17.63 12.80 21.22 24 T_KAM_HTML_FONT_INVALID 45052 15.85 14.30 16.99 25 RCVD_IN_MSPIKE_H3 43173 11.82 5.80 16.28 26 XM_Body_Dirty_Words 37789 13.37 12.19 14.25 27 XM_DKIMWhitelistDomains 36800 7.98 0.02 13.88 28 XM_Multi_Part_URI 36644 14.14 14.58 13.82 29 BAYES_00 34462 7.70 0.56 13.00 30 ALL_TRUSTED 32415 7.35 0.78 12.22 31 RCVD_IN_RP_SAFE 31503 8.54 4.03 11.88 32 RCVD_IN_MSPIKE_H4 31281 8.76 4.68 11.80 33 RCVD_IN_RP_CERTIFIED 29263 7.76 3.35 11.03 34 XM_B_Unsub 28733 10.07 9.03 10.84 35 XM_B_Phish_Phrases 25511 7.55 4.76 9.62 36 TR_XM_DK_Bayes 25193 5.63 0.42 9.50 37 TR_XM_DK_Bayes1 24684 5.52 0.41 9.31 38 UNPARSEABLE_RELAY 24660 6.87 3.61 9.30 39 HTML_IMAGE_RATIO_02 24095 7.67 5.76 9.09 40 XM_DK_Undo_02 23949 20.62 36.23 9.03 41 BAYES_60 23147 9.28 10.03 8.73 42 TR_XM_DK_Bayes2 22957 5.10 0.31 8.66 43 XM_Evil_Numbers_Gen 22537 7.27 5.62 8.50 44 XM_SendGrid 22304 5.89 2.50 8.41 45 XMStrtUSub 21946 6.00 2.93 8.28 46 LOTS_OF_MONEY 21694 15.81 26.10 8.18 47 LotsOfNums_01 20789 8.31 8.93 7.84 48 TR_XM_DKIM_Undo 18389 15.70 27.53 6.93 49 TooManyTo_001 17787 5.97 4.97 6.71 50 BAYES_99 17430 16.45 29.76 6.57 51 T_TooManySym_01 16952 4.18 1.19 6.39 52 HTML_IMAGE_RATIO_04 16778 5.00 3.21 6.33 53 XM_B_SpammyWords3 16704 7.60 9.36 6.30 54 BAYES_80 15192 8.95 13.30 5.73 55 MPART_ALT_DIFF 15146 6.31 7.12 5.71 56 FSL_BULK_SIG 14965 13.26 23.53 5.64 57 BOTNET_IPINHOSTNAME 14700 6.54 7.90 5.54 58 XMSexyCombo_05 14246 6.15 7.20 5.37 59 TR_XM_DK_SendGrid 13824 3.58 1.38 5.21 60 XM_H_Long_From01 13442 4.19 3.02 5.07 61 BAYES_999 13337 12.57 22.73 5.03 62 RELAYCOUNTRY_META 12805 15.61 30.13 4.83 63 IN_ZIMBRA_NJ_WHITELIST 12495 2.71 0.02 4.71 64 BAYES_95 10853 4.94 6.08 4.09 65 TR_DCC_Bayes_99 10793 11.75 22.10 4.07 66 TM2_M_URI_OPT_OUT 10792 3.14 1.88 4.07 67 XMSubMetaSx_00 10786 4.84 5.89 4.07 68 XMNumbers 10498 3.27 2.34 3.96 69 BAYES_40 10448 3.37 2.61 3.94 70 FROM_EXCESS_BASE64 10209 2.90 1.62 3.85 71 XM_UncommonTLD01 10159 6.25 9.52 3.83 72 MIME_QP_LONG_LINE 9926 2.52 0.87 3.74 73 T_TooManySym_02 9691 2.29 0.44 3.65 74 RCVD_IN_IADB_LISTED 9536 2.42 0.83 3.60 75 MIME_HTML_ONLY_MULTI 9400 2.56 1.24 3.54 76 HTML_IMAGE_RATIO_06 8970 3.05 2.59 3.38 77 TR_XM_PhishingBody 8486 3.74 4.47 3.20 78 XM_H_Trusted_IP 8445 1.83 0.00 3.18 79 RCVD_IN_IADB_SPF 8373 2.12 0.72 3.16 80 MIME_HTML_MOSTLY 8140 4.39 6.16 3.07 81 BAYES_20 8066 2.46 1.69 3.04 82 RCVD_IN_MSPIKE_H5 7933 1.92 0.47 2.99 83 INVALID_MSGID 7720 1.74 0.16 2.91 84 RCVD_IN_IADB_SENDERID 7496 1.90 0.65 2.83 85 RCVD_IN_IADB_DK 7268 1.86 0.67 2.74 86 T_REMOTE_IMAGE 7205 2.30 1.74 2.72 87 ANY_BOUNCE_MESSAGE 6868 1.85 0.86 2.59 88 BOUNCE_MESSAGE 6867 1.85 0.86 2.59 89 TO_MALFORMED 6467 1.43 0.08 2.44 90 TVD_RCVD_IP 6361 1.42 0.10 2.40 91 UNTRUSTED_Relay 6268 11.58 24.00 2.36 92 XM_B_SpammyTLD 6208 3.24 4.46 2.34 93 DKIM_INVALID 6153 2.27 2.21 2.32 94 MAILING_LIST_MULTI 6008 1.61 0.72 2.27 95 RCVD_IN_IADB_VOUCHED 5727 1.42 0.42 2.16 96 HELO_MISC_IP 5712 1.32 0.20 2.15 97 CK_HELO_DYNAMIC_SPLIT_IP 5703 1.32 0.20 2.15 98 T_FONT_INVIS_NAKED_TO 5681 2.33 2.58 2.14 99 HTML_IMAGE_RATIO_08 5570 2.29 2.54 2.10 100 TR_Symld_Words 5512 1.60 0.94 2.08 101 RELAYCOUNTRY_CA 5433 3.35 5.09 2.05 102 BAYES_05 5310 1.45 0.71 2.00 103 URI_NOVOWEL 5215 1.43 0.71 1.97 104 XM_CamelCaseFrm001 5156 1.72 1.41 1.94 105 HTML_FONT_FACE_BAD 4932 1.22 0.35 1.86 106 USER_IN_DEF_DKIM_WL 4916 1.06 0.00 1.85 107 T_XMDrugObfuBody_14 4795 1.35 0.73 1.81 108 IN_HORDE_ADDRESS_BOOK 4688 1.04 0.06 1.77 109 XMGappySubj_01 4632 1.03 0.05 1.75 110 XM_PDF 4623 1.10 0.24 1.74 111 XMBSHREFv2 4615 1.04 0.11 1.74 112 TR_XM_SpammyWords2 4435 5.99 11.81 1.67 113 SUBJ_ALL_CAPS 4418 6.66 13.39 1.67 114 BOTNET 4354 5.40 10.47 1.64 115 XM_ProductURIs 4251 1.21 0.67 1.60 116 XMStockSpam_06 4176 1.28 0.88 1.57 117 T_TooManySym_03 4142 0.94 0.11 1.56 118 XM_DK_Undo_01 3964 1.21 0.82 1.49 119 T_XMDrugObfuBody_08 3958 1.99 2.66 1.49 120 XMBdyGiftCard01 3921 1.48 1.48 1.48 121 TR_XM_SB_Phish 3773 1.16 0.82 1.42 122 RCVD_IN_IADB_OPTIN 3761 0.96 0.33 1.42 123 XMSubPhish11 3730 1.13 0.75 1.41 124 LH_URI_DOM_IN_PATH 3679 1.50 1.65 1.39 125 TooManyTo_002 3598 0.89 0.25 1.36 126 XMDiploma_00 3560 1.37 1.42 1.34 127 HTML_MIME_NO_HTML_TAG 3539 10.54 22.94 1.33 128 URI_TRY_3LD 3491 1.56 1.89 1.32 129 XMSubNoVowel 3478 1.87 2.63 1.31 130 URI_HEX 3431 1.87 2.64 1.29 131 XM_OfRef6 3422 1.93 2.80 1.29 132 TR_LOTS_OF_MONEY3 3182 9.18 19.94 1.20 133 XMSexyCombo_01 3148 1.28 1.40 1.19 134 RCVD_IN_BL_SPAMCOP_NET 3133 3.32 6.20 1.18 135 XM_B_Phish66 3069 1.93 2.96 1.16 136 XM_UB50 3067 6.75 14.28 1.16 137 XM_H_Long_From02 3027 0.83 0.41 1.14 138 KHOP_HELO_FCRDNS 3007 1.27 1.46 1.13 139 TM2_M_VERY_LONG_WORD 2999 1.35 1.65 1.13 140 TR_MSPIKEBAYES00 2922 0.65 0.05 1.10 141 XMBody_17 2912 8.66 18.85 1.10 142 XM_ShortIntro_01 2870 0.96 0.80 1.08 143 XMBrknScrpt_02 2853 2.70 4.89 1.08 144 XM_GoogleGroups 2841 0.73 0.26 1.07 145 T_TooManySym_04 2688 0.60 0.04 1.01 146 DKIM_ADSP_CUSTOM_MED 2674 0.79 0.49 1.01 147 XM_SPF_SoftFail 2657 1.40 1.93 1.00 148 XMBody_95 2495 0.57 0.08 0.94 149 DKIM_ADSP_NXDOMAIN 2489 0.71 0.40 0.94 150 NO_DNS_FOR_FROM 2465 0.67 0.32 0.93 151 TooManyTo_003 2410 0.61 0.20 0.91 152 XMPhish30 2399 0.76 0.57 0.90 153 HTML_TAG_BALANCE_BODY 2376 0.79 0.64 0.90 154 NUMERIC_HTTP_ADDR 2374 0.66 0.34 0.90 155 PDS_OTHER_BAD_TLD 2312 0.97 1.11 0.87 156 XM_B_Unsub2 2299 0.91 0.96 0.87 157 XM_S_SubURI 2264 0.52 0.06 0.85 158 TR_MetaPhish_Combo_01 2199 0.68 0.49 0.83 159 XMSexyCombo_04 2145 0.71 0.59 0.81 160 XMPhish08 2089 0.64 0.44 0.79 161 T_FILL_THIS_FORM_SHORT 2065 1.03 1.38 0.78 162 XMGenDplmaNmb 2064 0.76 0.74 0.78 163 XM_B_SpammyWords4 2062 1.04 1.40 0.78 164 T_XMHurry_00 2028 1.31 2.05 0.76 165 T_TooManySym_05 2021 0.44 0.01 0.76 166 RCVD_IN_MSPIKE_BL 2003 4.02 8.43 0.76 167 RDNS_DYNAMIC 1979 0.70 0.63 0.75 168 HELO_NODOT 1977 6.25 13.66 0.75 169 HELO_NO_DOMAIN 1976 6.25 13.66 0.75 170 T_XMDrugObfuBody_00 1921 0.73 0.73 0.72 171 TooManyTo_004 1877 0.49 0.19 0.71 172 XMSubMetaI_00 1876 0.62 0.50 0.71 173 NML_ADSP_CUSTOM_MED 1849 0.59 0.45 0.70 174 USER_IN_WELCOMELIST 1752 0.38 0.00 0.66 175 USER_IN_WHITELIST 1752 0.38 0.00 0.66 176 RCVD_IN_MSPIKE_L3 1719 2.59 5.21 0.65 177 XMHTML_After_End 1701 0.65 0.65 0.64 178 RELAYCOUNTRY_GB 1655 0.70 0.80 0.62 179 PLING_QUERY 1636 0.50 0.33 0.62 180 TooManyTo_005 1617 0.43 0.18 0.61 181 XM_B_COPY_HTML 1573 0.50 0.38 0.59 182 XM_B_COVIDMETA 1571 0.77 1.00 0.59 183 TR_XM_COVIDMETA1 1554 0.51 0.41 0.59 184 FORGED_GMAIL_RCVD 1435 0.50 0.45 0.54 185 XM_B_REG_HTML 1430 0.51 0.47 0.54 186 DIET_1 1423 0.52 0.50 0.54 187 HTTPS_HTTP_MISMATCH 1423 0.61 0.71 0.54 188 HTML_IMAGE_ONLY_20 1395 0.35 0.11 0.53 189 TR_XM_SpammyWords3 1384 2.48 5.13 0.52 190 SpammyFromTLD_01 1371 2.16 4.38 0.52 191 XM_H_PHPMailer 1350 0.49 0.48 0.51 192 MISSING_HEADERS 1337 6.06 13.56 0.50 193 XMSubMetaSxObfu_02 1318 0.45 0.38 0.50 194 TR_XM_UnparsRelay 1259 0.77 1.18 0.47 195 XMNoVowels 1244 0.42 0.36 0.47 196 XMHTMLBadTable_001 1239 0.45 0.43 0.47 197 XMLngstWrd_00 1217 0.55 0.66 0.46 198 XMCapTrack 1216 0.35 0.21 0.46 199 XM_DIRTYINTL 1207 1.30 2.43 0.46 200 XMBody_78 1206 0.53 0.64 0.45 ----------------------------------------------------------------------