Email: 417531 Autolearn: 0 AvgScore: 3.39 AvgScanTime: 1.36 sec Spam: 135518 Autolearn: 0 AvgScore: 13.84 AvgScanTime: 1.48 sec Ham: 282013 Autolearn: 0 AvgScore: -1.63 AvgScanTime: 1.30 sec Time Spent Running SA: 157.81 hours Time Spent Processing Spam: 55.69 hours Time Spent Processing Ham: 102.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127978 90.29 94.44 88.30 2 DKIM_SIGNED 120848 82.75 89.17 79.67 3 XM_DK_Pass 118474 81.56 87.42 78.74 4 DKIM_VALID 116597 80.12 86.04 77.28 5 DCC_CHECK 108411 58.18 80.00 47.69 6 XM_B_Unicode 106228 77.02 78.39 76.36 7 RELAYCOUNTRY_US 103087 82.18 76.07 85.12 8 XMListUnsubscribeExists 99145 61.55 73.16 55.97 9 XM_B_SpammyWords 97690 57.57 72.09 50.59 10 DKIM_VALID_AU 93224 65.29 68.79 63.61 11 XM_DK_Undo_02 69619 22.68 51.37 8.89 12 TR_XM_DKIM_Undo 59623 18.65 44.00 6.46 13 XM_B_SpammyWords2 57527 29.46 42.45 23.22 14 LOC_TINY_FONT_1 56646 34.49 41.80 30.97 15 BAYES_99 56552 17.81 41.73 6.31 16 XM_B_Unicode3 51852 44.76 38.26 47.88 17 HTML_FONT_LOW_CONTRAST 49575 32.81 36.58 31.00 18 BAYES_999 46697 14.65 34.46 5.13 19 TR_DCC_Bayes_99 45118 13.40 33.29 3.84 20 RCVD_IN_MSPIKE_H2 44217 28.99 32.63 27.24 21 BAYES_50 43540 46.67 32.13 53.66 22 DKIM_VALID_EF 40931 29.99 30.20 29.89 23 MIME_HTML_ONLY 37643 26.52 27.78 25.92 24 FVGT_m_MULTI_ODD 33976 23.53 25.07 22.79 25 T_KAM_HTML_FONT_INVALID 32362 19.04 23.88 16.72 26 RELAYCOUNTRY_META 32017 10.80 23.63 4.63 27 XM_Multi_Part_URI 31008 17.86 22.88 15.45 28 T_TM2_M_HEADER_IN_MSG 29077 22.21 21.46 22.57 29 XMSubLong 28699 21.49 21.18 21.65 30 RCVD_IN_MSPIKE_WL 27784 28.05 20.50 31.68 31 DCC_CHECK_NEGATIVE 24777 40.37 18.28 50.99 32 XM_Body_Dirty_Words 24682 16.63 18.21 15.88 33 TR_XM_SpammyWords2 23877 6.83 17.62 1.65 34 BOTNET 21026 6.28 15.52 1.84 35 UNTRUSTED_Relay 19895 6.26 14.68 2.22 36 XM_B_SpammyWords3 18916 8.38 13.96 5.70 37 LOTS_OF_MONEY 18673 8.95 13.78 6.63 38 XM_B_Unsub 18295 12.33 13.50 11.77 39 XM_UncommonTLD01 17929 6.69 13.23 3.55 40 LotsOfNums_01 16826 9.41 12.42 7.97 41 RCVD_IN_MSPIKE_H3 16251 15.86 11.99 17.72 42 HTML_IMAGE_RATIO_02 16097 9.91 11.88 8.97 43 BOTNET_IPINHOSTNAME 15959 7.53 11.78 5.50 44 TR_XM_SpammyWords4 15479 6.86 11.42 4.67 45 RCVD_IN_BL_SPAMCOP_NET 15037 4.24 11.10 0.94 46 XMSexyCombo_05 14306 7.45 10.56 5.96 47 MPART_ALT_DIFF 14033 8.78 10.36 8.02 48 MIME_HTML_MOSTLY 13292 5.57 9.81 3.53 49 XM_Evil_Numbers_Gen 12759 9.83 9.41 10.03 50 BAYES_80 11897 6.09 8.78 4.79 51 FSL_BULK_SIG 11485 6.99 8.47 6.28 52 RELAYCOUNTRY_CA 11244 3.74 8.30 1.55 53 XMSubMetaSx_00 10623 4.80 7.84 3.34 54 XM_B_Phish_Phrases 10563 6.31 7.79 5.60 55 BAYES_60 10553 7.78 7.79 7.78 56 RCVD_IN_MSPIKE_H4 10461 10.44 7.72 11.75 57 UNPARSEABLE_RELAY 10072 8.80 7.43 9.45 58 TR_XM_UnparsRelay 9849 6.67 7.27 6.39 59 RCVD_IN_RP_SAFE 9596 10.55 7.08 12.21 60 XM_OfRef6 9329 2.84 6.88 0.89 61 XM_H_Long_From01 8941 5.81 6.60 5.44 62 XMStrtUSub 8824 6.95 6.51 7.17 63 TooManyTo_001 8139 6.19 6.01 6.28 64 RCVD_IN_RP_CERTIFIED 8108 9.64 5.98 11.40 65 TR_XM_PhishingBody 7841 3.27 5.79 2.06 66 RCVD_IN_MSPIKE_BL 7776 2.13 5.74 0.39 67 TR_XM_MSPIKECOMBO 7664 2.10 5.66 0.39 68 SpammyFromTLD_01 7534 2.10 5.56 0.44 69 XM_UB50 7194 2.48 5.31 1.12 70 XM_SendGrid 7007 7.48 5.17 8.59 71 HTML_IMAGE_RATIO_08 6947 3.41 5.13 2.59 72 TR_XM_SpammyWords5 6905 2.94 5.10 1.90 73 HTML_IMAGE_RATIO_04 6858 6.74 5.06 7.55 74 BAYES_95 6690 3.68 4.94 3.07 75 XM_UB99 6086 1.46 4.49 0.00 76 HTML_IMAGE_RATIO_06 5775 3.98 4.26 3.84 77 RELAYCOUNTRY_FR 5775 1.53 4.26 0.22 78 T_FILL_THIS_FORM_SHORT 5567 1.84 4.11 0.75 79 RCVD_IN_PSBL 5500 1.57 4.06 0.37 80 XM_DK_Undo_01 5355 2.23 3.95 1.41 81 RCVD_IN_RP_RNBL 5345 1.31 3.94 0.05 82 TM2_M_URI_OPT_OUT 5326 4.90 3.93 5.37 83 XMNumbers 5272 3.58 3.89 3.44 84 URIBL_SBL_A 5203 1.39 3.84 0.22 85 XM_UB999 4891 1.17 3.61 0.00 86 XMBdyGiftCard01 4816 2.32 3.55 1.72 87 RCVD_IN_MSPIKE_L5 4800 1.21 3.54 0.08 88 XMBody_17 4630 1.97 3.42 1.28 89 XM_SPF_SoftFail 4622 2.07 3.41 1.42 90 TR_LOTS_OF_MONEY3 4585 1.32 3.38 0.33 91 FROM_EXCESS_BASE64 4512 3.88 3.33 4.15 92 URI_HEX 4356 1.96 3.21 1.36 93 SpammyFromTLD_02 4299 1.12 3.17 0.13 94 XM_B_SpammyTLD 4259 3.06 3.14 3.02 95 DKIM_INVALID 4251 2.63 3.14 2.39 96 XMBrknScrpt_02 4042 1.45 2.98 0.72 97 TR_XM_DK_SendGrid 4026 4.88 2.97 5.80 98 FORGED_GMAIL_RCVD 3907 1.33 2.88 0.58 99 XM_B_SpammyWords4 3855 1.27 2.84 0.52 100 TR_XM_MaxBayes 3800 0.92 2.80 0.01 101 XM_B_Phish66 3711 1.53 2.74 0.95 102 XM_DIRTYINTL 3519 1.12 2.60 0.41 103 BOTNET_NORDNS 3445 0.84 2.54 0.02 104 SUBJ_ALL_CAPS 3381 1.90 2.49 1.61 105 XMSexyCombo_01 3223 1.10 2.38 0.49 106 T_REMOTE_IMAGE 3216 2.85 2.37 3.07 107 TR_XM_FormFill 3120 0.75 2.30 0.01 108 XMDiploma_00 3097 1.57 2.29 1.22 109 XM_CamelCaseFrm001 3095 1.91 2.28 1.73 110 MIME_HTML_ONLY_MULTI 3040 4.58 2.24 5.70 111 KHOP_HELO_FCRDNS 3040 1.58 2.24 1.26 112 XM_OfRef7 2953 0.79 2.18 0.12 113 T_XMDrugObfuBody_08 2945 1.77 2.17 1.57 114 PDS_OTHER_BAD_TLD 2926 1.79 2.16 1.61 115 T_TooManySym_01 2915 4.67 2.15 5.87 116 TR_Mismatch_TLD_02 2860 0.73 2.11 0.06 117 XM_B_Unsub2 2798 1.28 2.06 0.91 118 T_XMDrugObfuBody_14 2776 1.98 2.05 1.95 119 XMSubNoVowel 2696 2.39 1.99 2.59 120 TM2_M_VERY_LONG_WORD 2665 1.62 1.97 1.45 121 URI_TRY_3LD 2660 1.35 1.96 1.05 122 TR_XM_BayesRelay 2564 0.62 1.89 0.01 123 XM_UB60 2544 0.73 1.88 0.18 124 MIME_QP_LONG_LINE 2493 3.15 1.84 3.78 125 BAYES_40 2429 3.60 1.79 4.47 126 URI_NOVOWEL 2300 2.05 1.70 2.22 127 T_XMHurry_00 2247 1.19 1.66 0.96 128 XMStockSpam_06 2129 2.09 1.57 2.34 129 RELAYCOUNTRY_IN 2115 0.55 1.56 0.07 130 XM_UB80 2111 0.56 1.56 0.08 131 FROM_SUSPICIOUS_NTLD 2103 0.57 1.55 0.10 132 T_XMDrugObfuBody_00 2097 1.01 1.55 0.75 133 TR_XM_PHPDW 2071 0.73 1.53 0.35 134 URI_GOOGLE_PROXY 2059 0.53 1.52 0.06 135 RCVD_IN_IADB_LISTED 2047 2.88 1.51 3.54 136 XMPhish08 2041 0.67 1.51 0.27 137 TR_XM_PHPForged 2024 0.68 1.49 0.30 138 TR_XM_FormFill2 2020 0.68 1.49 0.29 139 XM_H_PHPOS 2015 0.68 1.49 0.29 140 TR_XM_SpammyWords3 1992 0.69 1.47 0.32 141 FROM_SUSPICIOUS_NTLD_FP 1984 0.53 1.46 0.09 142 NUMERIC_HTTP_ADDR 1967 0.80 1.45 0.48 143 XMSubMetaI_00 1958 0.87 1.44 0.59 144 HTML_MIME_NO_HTML_TAG 1908 1.30 1.41 1.24 145 HK_RANDOM_REPLYTO 1884 0.59 1.39 0.21 146 BAYES_20 1882 2.70 1.39 3.34 147 TR_Symld_Words 1861 1.45 1.37 1.49 148 DIET_1 1843 0.70 1.36 0.39 149 RCVD_IN_IADB_SPF 1834 2.54 1.35 3.11 150 RCVD_IN_MSPIKE_L4 1824 0.45 1.35 0.01 151 LongTLD 1778 0.51 1.31 0.12 152 XMGenDplmaNmb 1768 0.83 1.30 0.61 153 TR_XM_RelayPhish 1751 0.48 1.29 0.08 154 MAILING_LIST_MULTI 1692 1.70 1.25 1.91 155 RCVD_IN_IADB_DK 1674 2.21 1.24 2.68 156 RCVD_IN_IADB_SENDERID 1666 2.28 1.23 2.79 157 TR_XM_SB_Phish 1661 2.19 1.23 2.65 158 XM_B_COVIDMETA 1641 0.90 1.21 0.74 159 SUBJ_DOLLARS 1612 0.71 1.19 0.48 160 XMSubPhish11 1587 2.16 1.17 2.63 161 HK_SCAM 1575 0.40 1.16 0.04 162 MIME_CHARSET_FARAWAY 1563 0.46 1.15 0.13 163 XM_ProductURIs 1548 1.22 1.14 1.25 164 TVD_SPACE_RATIO_MINFP 1537 0.74 1.13 0.55 165 TR_XM_INV_DKIM 1490 0.47 1.10 0.16 166 XMSexyCombo_04 1469 0.48 1.08 0.19 167 XM_URI_RBL 1460 0.47 1.08 0.18 168 XMSubMetaSxObfu_03 1422 0.58 1.05 0.35 169 DKIM_ADSP_CUSTOM_MED 1412 0.98 1.04 0.95 170 RELAYCOUNTRY_DE 1390 0.63 1.03 0.45 171 HTML_IMAGE_ONLY_16 1376 0.46 1.02 0.19 172 T_Symld_Words_02 1350 0.50 1.00 0.26 173 URG_BIZ 1331 0.34 0.98 0.03 174 RDNS_DYNAMIC 1321 0.77 0.97 0.68 175 XMHTML_After_End 1285 0.64 0.95 0.50 176 ALL_TRUSTED 1271 7.72 0.94 10.98 177 CHARSET_FARAWAY_HEADER 1258 0.34 0.93 0.06 178 XMPhish30 1219 0.63 0.90 0.50 179 MONEY_FRAUD_8 1214 0.29 0.90 0.00 180 TR_Caps_n_Bayes_99 1210 0.42 0.89 0.19 181 FILL_THIS_FORM 1192 0.44 0.88 0.23 182 NML_ADSP_CUSTOM_MED 1188 0.72 0.88 0.64 183 INVESTMENT_ADVICE 1188 0.34 0.88 0.09 184 DEAR_BENEFICIARY 1170 0.28 0.86 0.00 185 MONEY_FORM 1162 0.28 0.86 0.01 186 XM_ShortIntro_01 1162 0.62 0.86 0.50 187 HTTPS_HTTP_MISMATCH 1161 0.70 0.86 0.63 188 XMLngstWrd_00 1154 0.56 0.85 0.41 189 XMSubMetaSSx_00 1144 0.39 0.84 0.17 190 XM_Body_Obfu01 1131 0.51 0.83 0.36 191 XM_OfRef8 1122 0.28 0.83 0.01 192 BAYES_00 1109 9.97 0.82 14.37 193 XM_UB95 1101 0.28 0.81 0.02 194 T_FILL_THIS_FORM_LOAN 1092 0.31 0.81 0.07 195 XM_H_Undi_Recip 1088 0.39 0.80 0.19 196 TR_XM_COVIDMETA4 1087 0.41 0.80 0.23 197 XM_H_Long_From02 1083 1.06 0.80 1.18 198 RCVD_IN_MSPIKE_H5 1072 1.75 0.79 2.21 199 XM_LoanWordsFrm 1071 0.28 0.79 0.03 200 XMBody_78 1064 0.55 0.79 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 249022 90.29 94.44 88.30 2 RELAYCOUNTRY_US 240059 82.18 76.07 85.12 3 DKIM_SIGNED 224672 82.75 89.17 79.67 4 XM_DK_Pass 222058 81.56 87.42 78.74 5 DKIM_VALID 217942 80.12 86.04 77.28 6 XM_B_Unicode 215342 77.02 78.39 76.36 7 DKIM_VALID_AU 179375 65.29 68.79 63.61 8 XMListUnsubscribeExists 157841 61.55 73.16 55.97 9 BAYES_50 151329 46.67 32.13 53.66 10 DCC_CHECK_NEGATIVE 143790 40.37 18.28 50.99 11 XM_B_SpammyWords 142682 57.57 72.09 50.59 12 XM_B_Unicode3 135020 44.76 38.26 47.88 13 DCC_CHECK 134499 58.18 80.00 47.69 14 RCVD_IN_MSPIKE_WL 89345 28.05 20.50 31.68 15 HTML_FONT_LOW_CONTRAST 87417 32.81 36.58 31.00 16 LOC_TINY_FONT_1 87346 34.49 41.80 30.97 17 DKIM_VALID_EF 84306 29.99 30.20 29.89 18 RCVD_IN_MSPIKE_H2 76810 28.99 32.63 27.24 19 MIME_HTML_ONLY 73095 26.52 27.78 25.92 20 XM_B_SpammyWords2 65472 29.46 42.45 23.22 21 FVGT_m_MULTI_ODD 64275 23.53 25.07 22.79 22 T_TM2_M_HEADER_IN_MSG 63653 22.21 21.46 22.57 23 XMSubLong 61044 21.49 21.18 21.65 24 RCVD_IN_MSPIKE_H3 49977 15.86 11.99 17.72 25 T_KAM_HTML_FONT_INVALID 47149 19.04 23.88 16.72 26 XM_Body_Dirty_Words 44773 16.63 18.21 15.88 27 XM_Multi_Part_URI 43569 17.86 22.88 15.45 28 BAYES_00 40520 9.97 0.82 14.37 29 XM_DKIMWhitelistDomains 36504 8.76 0.04 12.94 30 RCVD_IN_RP_SAFE 34445 10.55 7.08 12.21 31 XM_B_Unsub 33203 12.33 13.50 11.77 32 RCVD_IN_MSPIKE_H4 33124 10.44 7.72 11.75 33 RCVD_IN_RP_CERTIFIED 32139 9.64 5.98 11.40 34 ALL_TRUSTED 30973 7.72 0.94 10.98 35 TR_XM_DK_Bayes 29106 7.19 0.66 10.32 36 TR_XM_DK_Bayes1 28521 7.04 0.64 10.11 37 XM_Evil_Numbers_Gen 28273 9.83 9.41 10.03 38 UNPARSEABLE_RELAY 26658 8.80 7.43 9.45 39 TR_XM_DK_Bayes2 26501 6.54 0.61 9.40 40 HTML_IMAGE_RATIO_02 25294 9.91 11.88 8.97 41 XM_DK_Undo_02 25075 22.68 51.37 8.89 42 XM_SendGrid 24226 7.48 5.17 8.59 43 MPART_ALT_DIFF 22612 8.78 10.36 8.02 44 LotsOfNums_01 22484 9.41 12.42 7.97 45 BAYES_60 21934 7.78 7.79 7.78 46 HTML_IMAGE_RATIO_04 21296 6.74 5.06 7.55 47 XMStrtUSub 20213 6.95 6.51 7.17 48 LOTS_OF_MONEY 18700 8.95 13.78 6.63 49 TR_XM_DKIM_Undo 18228 18.65 44.00 6.46 50 TR_XM_UnparsRelay 18016 6.67 7.27 6.39 51 BAYES_99 17805 17.81 41.73 6.31 52 FSL_BULK_SIG 17716 6.99 8.47 6.28 53 TooManyTo_001 17706 6.19 6.01 6.28 54 XMSexyCombo_05 16817 7.45 10.56 5.96 55 T_TooManySym_01 16565 4.67 2.15 5.87 56 TR_XM_DK_SendGrid 16353 4.88 2.97 5.80 57 MIME_HTML_ONLY_MULTI 16069 4.58 2.24 5.70 58 XM_B_SpammyWords3 16064 8.38 13.96 5.70 59 XM_B_Phish_Phrases 15793 6.31 7.79 5.60 60 BOTNET_IPINHOSTNAME 15499 7.53 11.78 5.50 61 XM_H_Long_From01 15328 5.81 6.60 5.44 62 XM_H_Trusted_IP 15208 3.64 0.00 5.39 63 TM2_M_URI_OPT_OUT 15149 4.90 3.93 5.37 64 BAYES_999 14461 14.65 34.46 5.13 65 IN_ZIMBRA_NJ_WHITELIST 13852 3.33 0.05 4.91 66 BAYES_80 13515 6.09 8.78 4.79 67 TR_XM_SpammyWords4 13177 6.86 11.42 4.67 68 RELAYCOUNTRY_META 13064 10.80 23.63 4.63 69 BAYES_40 12605 3.60 1.79 4.47 70 FROM_EXCESS_BASE64 11694 3.88 3.33 4.15 71 HTML_IMAGE_RATIO_06 10836 3.98 4.26 3.84 72 TR_DCC_Bayes_99 10824 13.40 33.29 3.84 73 MIME_QP_LONG_LINE 10672 3.15 1.84 3.78 74 XM_UncommonTLD01 10000 6.69 13.23 3.55 75 RCVD_IN_IADB_LISTED 9992 2.88 1.51 3.54 76 MIME_HTML_MOSTLY 9962 5.57 9.81 3.53 77 XMNumbers 9690 3.58 3.89 3.44 78 XMSubMetaSx_00 9421 4.80 7.84 3.34 79 BAYES_20 9412 2.70 1.39 3.34 80 RCVD_IN_IADB_SPF 8777 2.54 1.35 3.11 81 T_REMOTE_IMAGE 8668 2.85 2.37 3.07 82 BAYES_95 8664 3.68 4.94 3.07 83 XM_B_SpammyTLD 8515 3.06 3.14 3.02 84 INVALID_MSGID 7864 2.06 0.53 2.79 85 RCVD_IN_IADB_SENDERID 7862 2.28 1.23 2.79 86 T_TooManySym_02 7713 2.00 0.46 2.73 87 RCVD_IN_IADB_DK 7571 2.21 1.24 2.68 88 TVD_RCVD_IP 7482 1.87 0.24 2.65 89 TR_XM_SB_Phish 7477 2.19 1.23 2.65 90 XMSubPhish11 7418 2.16 1.17 2.63 91 MSGID_NOFQDN1 7407 1.84 0.22 2.63 92 XMSubNoVowel 7300 2.39 1.99 2.59 93 HTML_IMAGE_RATIO_08 7297 3.41 5.13 2.59 94 DKIM_INVALID 6730 2.63 3.14 2.39 95 XMStockSpam_06 6600 2.09 1.57 2.34 96 TO_MALFORMED 6580 1.58 0.02 2.33 97 RCVD_IN_IADB_VOUCHED 6284 1.74 0.72 2.23 98 UNTRUSTED_Relay 6262 6.26 14.68 2.22 99 URI_NOVOWEL 6252 2.05 1.70 2.22 100 RCVD_IN_MSPIKE_H5 6244 1.75 0.79 2.21 101 BAYES_05 5861 1.61 0.63 2.08 102 TR_XM_PhishingBody 5811 3.27 5.79 2.06 103 HELO_MISC_IP 5690 1.49 0.38 2.02 104 T_XMDrugObfuBody_14 5493 1.98 2.05 1.95 105 MAILING_LIST_MULTI 5399 1.70 1.25 1.91 106 TR_XM_SpammyWords5 5359 2.94 5.10 1.90 107 BOTNET 5195 6.28 15.52 1.84 108 IN_HORDE_ADDRESS_BOOK 4912 1.23 0.15 1.74 109 USER_IN_DEF_DKIM_WL 4895 1.18 0.03 1.74 110 XM_CamelCaseFrm001 4875 1.91 2.28 1.73 111 XM_PDF 4870 1.25 0.26 1.73 112 XMBdyGiftCard01 4850 2.32 3.55 1.72 113 TR_XM_SpammyWords2 4649 6.83 17.62 1.65 114 SUBJ_ALL_CAPS 4554 1.90 2.49 1.61 115 PDS_OTHER_BAD_TLD 4537 1.79 2.16 1.61 116 T_XMDrugObfuBody_08 4435 1.77 2.17 1.57 117 ANY_BOUNCE_MESSAGE 4422 1.31 0.78 1.57 118 BOUNCE_MESSAGE 4420 1.31 0.78 1.57 119 RELAYCOUNTRY_CA 4380 3.74 8.30 1.55 120 XMBSHREFv2 4315 1.08 0.15 1.53 121 TR_MSPIKEBAYES00 4233 1.02 0.02 1.50 122 TR_Symld_Words 4188 1.45 1.37 1.49 123 HTML_FONT_FACE_BAD 4116 1.18 0.61 1.46 124 TM2_M_VERY_LONG_WORD 4080 1.62 1.97 1.45 125 RCVD_IN_IADB_OPTIN 4033 1.16 0.58 1.43 126 XM_SPF_SoftFail 4001 2.07 3.41 1.42 127 XM_DK_Undo_01 3971 2.23 3.95 1.41 128 URI_HEX 3831 1.96 3.21 1.36 129 TooManyTo_002 3787 1.07 0.51 1.34 130 XMBody_17 3599 1.97 3.42 1.28 131 KHOP_HELO_FCRDNS 3555 1.58 2.24 1.26 132 XM_ProductURIs 3533 1.22 1.14 1.25 133 HTML_MIME_NO_HTML_TAG 3503 1.30 1.41 1.24 134 XMDiploma_00 3441 1.57 2.29 1.22 135 XM_H_Long_From02 3336 1.06 0.80 1.18 136 XMGappySubj_01 3201 0.88 0.34 1.14 137 XM_UB50 3153 2.48 5.31 1.12 138 URI_TRY_3LD 2975 1.35 1.96 1.05 139 XM_GoogleGroups 2956 0.86 0.46 1.05 140 HTML_IMAGE_ONLY_20 2743 0.73 0.22 0.97 141 T_XMHurry_00 2717 1.19 1.66 0.96 142 XMBody_95 2687 0.73 0.26 0.95 143 XM_B_Phish66 2678 1.53 2.74 0.95 144 DKIM_ADSP_CUSTOM_MED 2674 0.98 1.04 0.95 145 RCVD_IN_BL_SPAMCOP_NET 2665 4.24 11.10 0.94 146 XM_B_Unsub2 2567 1.28 2.06 0.91 147 TooManyTo_003 2536 0.75 0.43 0.90 148 XM_OfRef6 2512 2.84 6.88 0.89 149 XM_RXBody 2463 0.76 0.52 0.87 150 T_TooManySym_03 2402 0.62 0.14 0.85 151 TR_MetaPhish_Combo_01 2115 0.68 0.54 0.75 152 T_XMDrugObfuBody_00 2111 1.01 1.55 0.75 153 T_FILL_THIS_FORM_SHORT 2101 1.84 4.11 0.75 154 XM_B_COVIDMETA 2100 0.90 1.21 0.74 155 TooManyTo_004 2091 0.62 0.37 0.74 156 XMBrknScrpt_02 2032 1.45 2.98 0.72 157 RELAYCOUNTRY_GB 2010 0.67 0.59 0.71 158 HELO_NODOT 1926 0.65 0.59 0.68 159 RDNS_DYNAMIC 1904 0.77 0.97 0.68 160 TooManyTo_005 1876 0.55 0.31 0.67 161 HELO_NO_DOMAIN 1853 0.63 0.57 0.66 162 NML_ADSP_CUSTOM_MED 1812 0.72 0.88 0.64 163 HTTPS_HTTP_MISMATCH 1769 0.70 0.86 0.63 164 HTML_TAG_BALANCE_BODY 1746 0.62 0.62 0.62 165 XMGenDplmaNmb 1713 0.83 1.30 0.61 166 XMSubMetaI_00 1674 0.87 1.44 0.59 167 FORGED_GMAIL_RCVD 1628 1.33 2.88 0.58 168 XMHTMLBadTable_001 1627 0.58 0.58 0.58 169 XM_E_Blogspot 1597 0.41 0.08 0.57 170 USER_IN_WELCOMELIST 1547 0.37 0.00 0.55 171 USER_IN_WHITELIST 1547 0.37 0.00 0.55 172 TVD_SPACE_RATIO_MINFP 1539 0.74 1.13 0.55 173 XM_B_SpammyWords4 1462 1.27 2.84 0.52 174 XM_B_REG_HTML 1426 0.55 0.66 0.51 175 XMPhish30 1423 0.63 0.90 0.50 176 XM_ShortIntro_01 1408 0.62 0.86 0.50 177 XMHTML_After_End 1403 0.64 0.95 0.50 178 XMSexyCombo_01 1379 1.10 2.38 0.49 179 NUMERIC_HTTP_ADDR 1363 0.80 1.45 0.48 180 XM_B_COPY_HTML 1357 0.47 0.43 0.48 181 SUBJ_DOLLARS 1352 0.71 1.19 0.48 182 TM2_M_A_HREF_HREF 1339 0.53 0.66 0.47 183 XMCapTrack 1324 0.38 0.20 0.47 184 XM_H_PHPMailer 1296 0.50 0.60 0.46 185 XMSubMetaSxObfu_02 1257 0.39 0.26 0.45 186 RELAYCOUNTRY_DE 1256 0.63 1.03 0.45 187 SpammyFromTLD_01 1251 2.10 5.56 0.44 188 XMBody_78 1250 0.55 0.79 0.44 189 XM_shorewaves_Whitelist 1246 0.30 0.00 0.44 190 TR_XM_Spammywords 1203 0.44 0.48 0.43 191 XM_S_SpammyWords 1203 0.44 0.48 0.43 192 TVD_SPACE_RATIO 1185 0.50 0.65 0.42 193 XMLngstWrd_00 1169 0.56 0.85 0.41 194 XMNoVowels 1159 0.39 0.34 0.41 195 XM_DIRTYINTL 1154 1.12 2.60 0.41 196 TR_BOTNET_NEGATE 1133 0.48 0.63 0.40 197 DKIM_ADSP_NXDOMAIN 1111 0.46 0.59 0.39 198 MPART_ALT_DIFF_COUNT 1109 0.42 0.48 0.39 199 RCVD_IN_MSPIKE_BL 1109 2.13 5.74 0.39 200 TR_XM_MSPIKECOMBO 1103 2.10 5.66 0.39 ----------------------------------------------------------------------