Email: 627354 Autolearn: 0 AvgScore: 2.42 AvgScanTime: 0.78 sec Spam: 127911 Autolearn: 0 AvgScore: 14.47 AvgScanTime: 1.24 sec Ham: 499443 Autolearn: 0 AvgScore: -0.67 AvgScanTime: 0.66 sec Time Spent Running SA: 136.31 hours Time Spent Processing Spam: 44.11 hours Time Spent Processing Ham: 92.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 120977 50.11 94.58 38.72 2 DKIM_SIGNED 116067 46.02 90.74 34.57 3 XM_DK_Pass 114771 45.46 89.73 34.13 4 DKIM_VALID 113026 44.63 88.36 33.43 5 XM_B_Unicode 101741 41.48 79.54 31.73 6 DCC_CHECK 100116 30.68 78.27 18.49 7 XMListUnsubscribeExists 95853 34.13 74.94 23.67 8 RELAYCOUNTRY_US 94163 44.25 73.62 36.73 9 DKIM_VALID_AU 92688 36.51 72.46 27.31 10 XM_B_SpammyWords 92552 31.45 72.36 20.98 11 XM_DK_Undo_02 77238 15.70 60.38 4.25 12 TR_XM_DKIM_Undo 62436 12.04 48.81 2.62 13 BAYES_99 62031 12.59 48.50 3.40 14 XM_B_SpammyWords2 52563 14.99 41.09 8.31 15 XM_B_Unicode3 52499 23.87 41.04 19.47 16 BAYES_999 51643 10.46 40.37 2.80 17 TR_DCC_Bayes_99 48578 8.96 37.98 1.53 18 LOC_TINY_FONT_1 48567 17.44 37.97 12.18 19 HTML_FONT_LOW_CONTRAST 44435 17.79 34.74 13.46 20 RCVD_IN_MSPIKE_H2 42456 16.16 33.19 11.80 21 DKIM_VALID_EF 40415 17.77 31.60 14.23 22 MIME_HTML_ONLY 35897 13.76 28.06 10.10 23 FVGT_m_MULTI_ODD 33397 15.06 26.11 12.23 24 BAYES_50 33233 46.86 25.98 52.21 25 T_KAM_HTML_FONT_INVALID 32644 11.07 25.52 7.37 26 RELAYCOUNTRY_META 32295 6.65 25.25 1.89 27 RCVD_IN_MSPIKE_WL 29465 16.16 23.04 14.39 28 XM_Body_Dirty_Words 26415 8.46 20.65 5.34 29 DCC_CHECK_NEGATIVE 25380 68.54 19.84 81.01 30 T_TM2_M_HEADER_IN_MSG 25003 12.97 19.55 11.29 31 TR_XM_SpammyWords2 25000 4.30 19.54 0.40 32 XMSubLong 24434 11.19 19.10 9.16 33 LOTS_OF_MONEY 20814 5.45 16.27 2.68 34 BOTNET 20310 3.83 15.88 0.74 35 UNTRUSTED_Relay 19793 3.77 15.47 0.77 36 XM_UncommonTLD01 18522 4.50 14.48 1.94 37 XM_Multi_Part_URI 18014 29.73 14.08 33.73 38 TR_XM_SpammyWords4 17931 4.03 14.02 1.47 39 MPART_ALT_DIFF 16554 4.84 12.94 2.76 40 RCVD_IN_MSPIKE_H3 16263 8.81 12.71 7.81 41 XM_Evil_Numbers_Gen 15647 5.41 12.23 3.66 42 RCVD_IN_BL_SPAMCOP_NET 15134 2.78 11.83 0.47 43 XM_B_Unsub 14919 6.27 11.66 4.89 44 XM_B_SpammyWords3 14777 3.77 11.55 1.77 45 MIME_HTML_MOSTLY 14205 3.26 11.11 1.25 46 XMSexyCombo_05 13854 3.64 10.83 1.79 47 BOTNET_IPINHOSTNAME 13784 4.46 10.78 2.85 48 HTML_IMAGE_RATIO_02 12746 4.96 9.96 3.67 49 LotsOfNums_01 12577 4.82 9.83 3.53 50 RCVD_IN_MSPIKE_H4 12297 6.22 9.61 5.35 51 UNPARSEABLE_RELAY 11833 4.88 9.25 3.76 52 RELAYCOUNTRY_CA 11704 2.42 9.15 0.70 53 TR_XM_UnparsRelay 11431 4.40 8.94 3.23 54 BAYES_80 11378 3.74 8.90 2.43 55 XM_OfRef6 10763 2.06 8.41 0.43 56 RCVD_IN_RP_SAFE 10076 5.41 7.88 4.78 57 XM_H_Long_From01 10073 3.81 7.88 2.77 58 URIBL_SBL_A 9748 1.97 7.62 0.52 59 BAYES_60 9563 5.68 7.48 5.21 60 FSL_BULK_SIG 9529 3.37 7.45 2.33 61 SpammyFromTLD_01 8272 1.52 6.47 0.25 62 XM_SendGrid 8155 4.01 6.38 3.40 63 XM_B_Phish_Phrases 8039 2.88 6.28 2.01 64 RCVD_IN_RP_CERTIFIED 7880 4.65 6.16 4.26 65 BAYES_95 7552 2.46 5.90 1.57 66 XM_DK_Undo_01 7543 1.70 5.90 0.63 67 XMSubMetaSx_00 7308 2.66 5.71 1.88 68 RELAYCOUNTRY_FR 6973 1.21 5.45 0.12 69 HTML_IMAGE_RATIO_04 6901 3.21 5.40 2.65 70 TR_XM_SpammyWords5 6792 1.62 5.31 0.67 71 TooManyTo_001 6612 3.50 5.17 3.07 72 XM_UB99 6264 1.00 4.90 0.00 73 XMNumbers 6256 2.45 4.89 1.82 74 T_FILL_THIS_FORM_SHORT 6248 1.28 4.88 0.36 75 TR_LOTS_OF_MONEY3 6037 1.10 4.72 0.18 76 TR_XM_MaxBayes 5633 0.91 4.40 0.02 77 SpammyFromTLD_02 5466 0.92 4.27 0.06 78 XM_UB50 5163 1.24 4.04 0.53 79 TR_XM_DK_SendGrid 5067 2.55 3.96 2.19 80 TR_XM_PhishingBody 4976 1.65 3.89 1.08 81 FORGED_GMAIL_RCVD 4722 0.96 3.69 0.26 82 XM_DIRTYINTL 4709 0.86 3.68 0.14 83 XMStrtUSub 4517 3.00 3.53 2.87 84 T_XMHurry_00 4502 0.90 3.52 0.23 85 URI_HEX 4399 1.24 3.44 0.68 86 XM_UB999 4352 0.69 3.40 0.00 87 XMBrknScrpt_02 4345 0.94 3.40 0.31 88 XMBdyGiftCard01 4148 0.87 3.24 0.27 89 GOOGLE_DOC_SUSP 4146 0.66 3.24 0.00 90 T_TooManySym_01 4082 3.00 3.19 2.96 91 RCVD_IN_RP_RNBL 3826 0.67 2.99 0.07 92 XM_OfRef7 3823 0.65 2.99 0.06 93 TR_XM_BayesRelay 3814 0.62 2.98 0.02 94 TR_XM_FormFill 3798 0.61 2.97 0.00 95 XMDiploma_00 3770 1.28 2.95 0.85 96 URIBL_DBL_SPAM 3713 0.60 2.90 0.00 97 MIME_HTML_ONLY_MULTI 3687 1.99 2.88 1.77 98 TM2_M_URI_OPT_OUT 3651 45.13 2.85 55.96 99 XMBody_17 3647 0.88 2.85 0.37 100 XM_RXBody 3531 0.68 2.76 0.14 101 HTML_IMAGE_RATIO_08 3460 1.63 2.71 1.36 102 FROM_EXCESS_BASE64 3408 1.87 2.66 1.66 103 DIET_1 3293 0.87 2.57 0.44 104 XM_SPF_SoftFail 3254 1.12 2.54 0.76 105 XM_UB60 3225 0.58 2.52 0.08 106 XM_B_SpammyTLD 3147 1.33 2.46 1.04 107 DKIM_INVALID 3041 1.39 2.38 1.13 108 KHOP_HELO_FCRDNS 2997 1.00 2.34 0.65 109 XM_B_SpammyWords4 2942 0.60 2.30 0.17 110 XM_CamelCaseFrm001 2900 1.25 2.27 0.99 111 URI_PHP_REDIR 2865 0.46 2.24 0.00 112 SUBJ_ALL_CAPS 2843 0.80 2.22 0.44 113 HK_RANDOM_REPLYTO 2805 0.52 2.19 0.09 114 LOADSA_MONEY_COMBO 2788 0.46 2.18 0.02 115 RCVD_IN_MSPIKE_BL 2778 0.47 2.17 0.04 116 TR_XM_MSPIKECOMBO 2722 0.46 2.13 0.03 117 URI_NO_WWW_BIZ_CGI 2682 0.43 2.10 0.00 118 RCVD_IN_PSBL 2664 0.47 2.08 0.06 119 PDS_OTHER_BAD_TLD 2659 0.76 2.08 0.43 120 HTML_IMAGE_RATIO_06 2633 1.82 2.06 1.76 121 XM_UB80 2598 0.43 2.03 0.02 122 TM2_M_VERY_LONG_WORD 2594 0.99 2.03 0.72 123 T_XMDrugObfuBody_14 2543 1.30 1.99 1.13 124 FILL_THIS_FORM 2534 0.57 1.98 0.21 125 FILL_THIS_FORM_LONG 2382 0.40 1.86 0.03 126 MONEY_FORM 2335 0.37 1.83 0.00 127 MIME_QP_LONG_LINE 2221 1.85 1.74 1.88 128 XM_OfRef8 2151 0.35 1.68 0.01 129 T_REMOTE_IMAGE 2147 1.60 1.68 1.59 130 XFER_LOTSA_MONEY 2132 0.35 1.67 0.01 131 MILLION_HUNDRED 2125 0.34 1.66 0.00 132 FROM_SUSPICIOUS_NTLD 2116 0.38 1.65 0.06 133 ADVANCE_FEE_5_NEW_FRM_MNY 2106 0.34 1.65 0.00 134 FROM_SUSPICIOUS_NTLD_FP 2083 0.38 1.63 0.06 135 XM_UB95 2048 0.33 1.60 0.01 136 TR_XM_PHPDW 2043 0.50 1.60 0.22 137 RELAYCOUNTRY_DE 1933 0.43 1.51 0.15 138 T_XMDrugObfuBody_08 1924 0.78 1.50 0.59 139 SUBJ_DOLLARS 1914 0.40 1.50 0.12 140 RELAYCOUNTRY_IN 1897 0.33 1.48 0.03 141 XMSexyCombo_01 1863 0.43 1.46 0.17 142 TR_Symld_Words 1861 0.78 1.45 0.61 143 XM_B_Phish66 1829 0.72 1.43 0.53 144 TR_XM_PHPForged 1826 0.42 1.43 0.16 145 MILLION_USD 1819 0.29 1.42 0.00 146 TR_XM_FormFill2 1796 0.41 1.40 0.16 147 T_FILL_THIS_FORM_LOAN 1796 0.31 1.40 0.03 148 XM_H_PHPOS 1787 0.41 1.40 0.15 149 XMStockSpam_06 1772 0.61 1.39 0.41 150 RCVD_IN_MSPIKE_L5 1733 0.29 1.35 0.02 151 RCVD_IN_IADB_LISTED 1731 1.55 1.35 1.60 152 XM_B_Unsub2 1714 0.75 1.34 0.59 153 URG_BIZ 1680 0.28 1.31 0.01 154 FONT_INVIS_LONG_LINE 1678 0.31 1.31 0.06 155 MONEY_FRAUD_5 1620 0.26 1.27 0.00 156 URI_NOVOWEL 1618 0.96 1.26 0.88 157 BAYES_40 1606 2.04 1.26 2.24 158 XMGenDplmaNmb 1588 0.53 1.24 0.35 159 TR_Mismatch_TLD_02 1578 0.28 1.23 0.03 160 XMSlimDrugH 1573 0.38 1.23 0.17 161 TR_MRelay_UG 1546 0.25 1.21 0.00 162 XMPhish08 1546 0.31 1.21 0.08 163 URI_TRY_3LD 1538 0.78 1.20 0.67 164 MONEY_NOHTML 1498 0.30 1.17 0.08 165 HTML_MIME_NO_HTML_TAG 1489 0.91 1.16 0.85 166 BOTNET_NORDNS 1482 0.24 1.16 0.01 167 RCVD_IN_IADB_SPF 1473 1.35 1.15 1.40 168 XM_URI_RBL 1466 0.31 1.15 0.10 169 DEAR_BENEFICIARY 1465 0.23 1.15 0.00 170 T_Symld_Words_02 1436 0.36 1.12 0.17 171 XMSubMetaSxObfu_03 1414 0.59 1.11 0.46 172 RCVD_IN_IADB_DK 1383 1.19 1.08 1.22 173 URIBL_BLACK 1382 0.23 1.08 0.01 174 NUMERIC_HTTP_ADDR 1373 0.29 1.07 0.09 175 INVALID_MSGID 1373 1.53 1.07 1.65 176 RCVD_IN_IADB_SENDERID 1372 1.22 1.07 1.26 177 TR_XM_SB_Phish 1360 0.82 1.06 0.76 178 MONEY_FRAUD_8 1353 0.22 1.06 0.00 179 LongTLD 1351 0.25 1.06 0.04 180 XM_Body_Obfu01 1316 0.27 1.03 0.08 181 ALL_TRUSTED 1313 49.34 1.03 61.72 182 TR_XM_INV_DKIM 1308 0.24 1.02 0.04 183 RDNS_DYNAMIC 1291 0.48 1.01 0.34 184 MAILING_LIST_MULTI 1281 0.92 1.00 0.90 185 TR_XM_COVIDMETA4 1268 0.28 0.99 0.09 186 HTTPS_HTTP_MISMATCH 1262 0.45 0.99 0.31 187 XMSubPhish11 1253 0.78 0.98 0.73 188 BAYES_20 1206 1.11 0.94 1.16 189 RELAYCOUNTRY_NL 1190 0.27 0.93 0.10 190 XMPhish30 1166 0.37 0.91 0.23 191 HK_SCAM 1164 0.19 0.91 0.01 192 MONEY_FORM_SHORT 1154 0.18 0.90 0.00 193 HTML_FONT_SIZE_HUGE 1151 0.32 0.90 0.17 194 TR_Caps_n_Bayes_99 1151 0.23 0.90 0.05 195 RELAYCOUNTRY_GB 1134 0.46 0.89 0.35 196 XMSubMetaI_00 1124 0.38 0.88 0.26 197 LONG_JUNK_URI 1110 0.19 0.87 0.01 198 TR_XM_SpammyWords3 1104 0.19 0.86 0.02 199 T_XMDrugObfuBody_00 1101 21.92 0.86 27.32 200 TR_XM_RelayPhish 1083 0.20 0.85 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 404613 68.54 19.84 81.01 2 ALL_TRUSTED 308234 49.34 1.03 61.72 3 TM2_M_URI_OPT_OUT 279487 45.13 2.85 55.96 4 BOUNCE_MESSAGE 279475 44.67 0.59 55.96 5 ANY_BOUNCE_MESSAGE 279475 44.67 0.59 55.96 6 BAYES_50 260745 46.86 25.98 52.21 7 HTML_MESSAGE 193384 50.11 94.58 38.72 8 RELAYCOUNTRY_US 183435 44.25 73.62 36.73 9 DKIM_SIGNED 172635 46.02 90.74 34.57 10 XM_DK_Pass 170455 45.46 89.73 34.13 11 XM_Multi_Part_URI 168487 29.73 14.08 33.73 12 DKIM_VALID 166981 44.63 88.36 33.43 13 XM_B_Unicode 158485 41.48 79.54 31.73 14 BAYES_00 154035 24.66 0.53 30.84 15 T_XMDrugObfuBody_00 136432 21.92 0.86 27.32 16 DKIM_VALID_AU 136377 36.51 72.46 27.31 17 XMListUnsubscribeExists 118235 34.13 74.94 23.67 18 XM_B_SpammyWords 104768 31.45 72.36 20.98 19 XM_B_Unicode3 97244 23.87 41.04 19.47 20 DCC_CHECK 92362 30.68 78.27 18.49 21 RCVD_IN_MSPIKE_WL 71888 16.16 23.04 14.39 22 DKIM_VALID_EF 71084 17.77 31.60 14.23 23 HTML_FONT_LOW_CONTRAST 67201 17.79 34.74 13.46 24 FVGT_m_MULTI_ODD 61068 15.06 26.11 12.23 25 LOC_TINY_FONT_1 60837 17.44 37.97 12.18 26 RCVD_IN_MSPIKE_H2 58911 16.16 33.19 11.80 27 T_TM2_M_HEADER_IN_MSG 56369 12.97 19.55 11.29 28 MIME_HTML_ONLY 50435 13.76 28.06 10.10 29 XMSubLong 45767 11.19 19.10 9.16 30 XM_B_SpammyWords2 41484 14.99 41.09 8.31 31 RCVD_IN_MSPIKE_H3 39022 8.81 12.71 7.81 32 T_KAM_HTML_FONT_INVALID 36819 11.07 25.52 7.37 33 XM_DKIMWhitelistDomains 28999 4.65 0.15 5.81 34 RCVD_IN_MSPIKE_H4 26737 6.22 9.61 5.35 35 XM_Body_Dirty_Words 26652 8.46 20.65 5.34 36 BAYES_60 26045 5.68 7.48 5.21 37 XM_B_Unsub 24401 6.27 11.66 4.89 38 RCVD_IN_RP_SAFE 23864 5.41 7.88 4.78 39 RCVD_IN_RP_CERTIFIED 21291 4.65 6.16 4.26 40 XM_DK_Undo_02 21241 15.70 60.38 4.25 41 UNPARSEABLE_RELAY 18777 4.88 9.25 3.76 42 HTML_IMAGE_RATIO_02 18353 4.96 9.96 3.67 43 XM_Evil_Numbers_Gen 18300 5.41 12.23 3.66 44 LotsOfNums_01 17639 4.82 9.83 3.53 45 XM_SendGrid 17006 4.01 6.38 3.40 46 BAYES_99 16984 12.59 48.50 3.40 47 TR_XM_UnparsRelay 16154 4.40 8.94 3.23 48 TooManyTo_001 15356 3.50 5.17 3.07 49 T_TooManySym_01 14767 3.00 3.19 2.96 50 TR_XM_DK_Bayes 14356 2.36 0.35 2.87 51 XMStrtUSub 14328 3.00 3.53 2.87 52 BOTNET_IPINHOSTNAME 14216 4.46 10.78 2.85 53 TR_XM_DK_Bayes1 14118 2.32 0.35 2.83 54 BAYES_999 14001 10.46 40.37 2.80 55 XM_H_Long_From01 13841 3.81 7.88 2.77 56 MPART_ALT_DIFF 13801 4.84 12.94 2.76 57 LOTS_OF_MONEY 13378 5.45 16.27 2.68 58 HTML_IMAGE_RATIO_04 13232 3.21 5.40 2.65 59 TR_XM_DKIM_Undo 13069 12.04 48.81 2.62 60 TR_XM_DK_Bayes2 12698 2.09 0.34 2.54 61 BAYES_80 12113 3.74 8.90 2.43 62 FSL_BULK_SIG 11643 3.37 7.45 2.33 63 IN_ZIMBRA_NJ_WHITELIST 11306 1.81 0.04 2.26 64 BAYES_40 11172 2.04 1.26 2.24 65 TR_XM_DK_SendGrid 10916 2.55 3.96 2.19 66 XM_B_Phish_Phrases 10029 2.88 6.28 2.01 67 XM_UncommonTLD01 9691 4.50 14.48 1.94 68 RELAYCOUNTRY_META 9437 6.65 25.25 1.89 69 XMSubMetaSx_00 9393 2.66 5.71 1.88 70 MIME_QP_LONG_LINE 9376 1.85 1.74 1.88 71 XMNumbers 9098 2.45 4.89 1.82 72 XMSexyCombo_05 8963 3.64 10.83 1.79 73 XM_H_Trusted_IP 8854 1.41 0.00 1.77 74 XM_B_SpammyWords3 8846 3.77 11.55 1.77 75 MIME_HTML_ONLY_MULTI 8825 1.99 2.88 1.77 76 HTML_IMAGE_RATIO_06 8779 1.82 2.06 1.76 77 T_TooManySym_02 8621 1.54 0.81 1.73 78 FROM_EXCESS_BASE64 8301 1.87 2.66 1.66 79 INVALID_MSGID 8236 1.53 1.07 1.65 80 RCVD_IN_IADB_LISTED 8012 1.55 1.35 1.60 81 T_REMOTE_IMAGE 7922 1.60 1.68 1.59 82 MSGID_NOFQDN1 7920 1.27 0.05 1.59 83 TVD_RCVD_IP 7914 1.28 0.09 1.58 84 BAYES_95 7861 2.46 5.90 1.57 85 TR_DCC_Bayes_99 7648 8.96 37.98 1.53 86 TR_XM_SpammyWords4 7359 4.03 14.02 1.47 87 RCVD_IN_IADB_SPF 7004 1.35 1.15 1.40 88 HTML_IMAGE_RATIO_08 6790 1.63 2.71 1.36 89 XM_PDF 6492 1.11 0.38 1.30 90 RCVD_IN_IADB_SENDERID 6292 1.22 1.07 1.26 91 TO_MALFORMED 6267 1.03 0.17 1.25 92 MIME_HTML_MOSTLY 6265 3.26 11.11 1.25 93 RCVD_IN_MSPIKE_H5 6129 1.12 0.71 1.23 94 RCVD_IN_IADB_DK 6109 1.19 1.08 1.22 95 BAYES_20 5788 1.11 0.94 1.16 96 DKIM_INVALID 5654 1.39 2.38 1.13 97 T_XMDrugObfuBody_14 5634 1.30 1.99 1.13 98 HTML_FONT_FACE_BAD 5436 1.02 0.74 1.09 99 TR_XM_PhishingBody 5388 1.65 3.89 1.08 100 HELO_MISC_IP 5370 0.87 0.06 1.08 101 XM_B_SpammyTLD 5210 1.33 2.46 1.04 102 XM_CamelCaseFrm001 4939 1.25 2.27 0.99 103 RCVD_IN_IADB_VOUCHED 4730 0.89 0.68 0.95 104 BAYES_05 4699 0.85 0.51 0.94 105 MAILING_LIST_MULTI 4506 0.92 1.00 0.90 106 XMBSHREFv2 4500 0.74 0.13 0.90 107 IN_HORDE_ADDRESS_BOOK 4498 0.75 0.16 0.90 108 USER_IN_DEF_DKIM_WL 4393 0.70 0.00 0.88 109 URI_NOVOWEL 4390 0.96 1.26 0.88 110 HTML_MIME_NO_HTML_TAG 4250 0.91 1.16 0.85 111 XMDiploma_00 4234 1.28 2.95 0.85 112 UNTRUSTED_Relay 3853 3.77 15.47 0.77 113 TR_XM_SB_Phish 3801 0.82 1.06 0.76 114 XM_SPF_SoftFail 3797 1.12 2.54 0.76 115 BOTNET 3693 3.83 15.88 0.74 116 XMSubPhish11 3649 0.78 0.98 0.73 117 TM2_M_VERY_LONG_WORD 3597 0.99 2.03 0.72 118 XMBody_95 3503 0.58 0.11 0.70 119 RELAYCOUNTRY_CA 3478 2.42 9.15 0.70 120 URI_HEX 3392 1.24 3.44 0.68 121 TR_XM_SpammyWords5 3353 1.62 5.31 0.67 122 URI_TRY_3LD 3325 0.78 1.20 0.67 123 KHOP_HELO_FCRDNS 3251 1.00 2.34 0.65 124 XM_DK_Undo_01 3136 1.70 5.90 0.63 125 RCVD_IN_IADB_OPTIN 3049 0.58 0.49 0.61 126 TooManyTo_002 3045 0.56 0.36 0.61 127 TR_Symld_Words 3028 0.78 1.45 0.61 128 XM_B_Unsub2 2970 0.75 1.34 0.59 129 XMGappySubj_01 2960 0.49 0.11 0.59 130 T_XMDrugObfuBody_08 2945 0.78 1.50 0.59 131 XM_H_Long_From02 2897 0.61 0.74 0.58 132 XM_B_Phish66 2669 0.72 1.43 0.53 133 TVD_SPACE_RATIO 2648 0.52 0.46 0.53 134 XM_UB50 2639 1.24 4.04 0.53 135 URIBL_SBL_A 2586 1.97 7.62 0.52 136 XM_GoogleGroups 2562 0.49 0.39 0.51 137 XM_ProductURIs 2425 0.54 0.77 0.49 138 DKIM_ADSP_CUSTOM_MED 2337 0.48 0.52 0.47 139 RCVD_IN_BL_SPAMCOP_NET 2325 2.78 11.83 0.47 140 XMSubMetaSxObfu_03 2277 0.59 1.11 0.46 141 SUBJ_ALL_CAPS 2195 0.80 2.22 0.44 142 XMSubNoVowel 2190 0.49 0.67 0.44 143 DIET_1 2188 0.87 2.57 0.44 144 XM_OfRef6 2164 2.06 8.41 0.43 145 T_TooManySym_03 2152 0.42 0.35 0.43 146 PDS_OTHER_BAD_TLD 2136 0.76 2.08 0.43 147 TooManyTo_003 2133 0.40 0.29 0.43 148 XMLngstWrd_00 2114 0.42 0.40 0.42 149 XMStockSpam_06 2063 0.61 1.39 0.41 150 TR_XM_SpammyWords2 1973 4.30 19.54 0.40 151 T_OBFU_PDF_ATTACH 1949 0.34 0.14 0.39 152 HTML_IMAGE_ONLY_20 1936 0.33 0.12 0.39 153 USER_IN_WELCOMELIST 1930 0.31 0.00 0.39 154 USER_IN_WHITELIST 1930 0.31 0.00 0.39 155 XMLngstWrd_01 1922 0.38 0.37 0.38 156 XM_B_COVIDMETA 1900 0.47 0.81 0.38 157 XMBody_17 1857 0.88 2.85 0.37 158 T_FILL_THIS_FORM_SHORT 1784 1.28 4.88 0.36 159 XMGenDplmaNmb 1764 0.53 1.24 0.35 160 TooManyTo_004 1748 0.33 0.27 0.35 161 XM_B_REG_HTML 1729 0.37 0.46 0.35 162 RELAYCOUNTRY_GB 1726 0.46 0.89 0.35 163 HTML_TAG_BALANCE_BODY 1720 0.44 0.81 0.34 164 RDNS_DYNAMIC 1708 0.48 1.01 0.34 165 XMHTMLBadTable_001 1703 0.42 0.75 0.34 166 XMLngstWrd_02 1645 0.33 0.33 0.33 167 NML_ADSP_CUSTOM_MED 1595 0.35 0.46 0.32 168 HTTPS_HTTP_MISMATCH 1568 0.45 0.99 0.31 169 XM_Body_Dirty_Words_01 1564 0.39 0.69 0.31 170 XMBrknScrpt_02 1546 0.94 3.40 0.31 171 TooManyTo_005 1542 0.30 0.25 0.31 172 XMHTML_After_End 1536 0.42 0.84 0.31 173 HELO_NO_DOMAIN 1508 0.32 0.38 0.30 174 HELO_NODOT 1508 0.32 0.39 0.30 175 TR_MetaPhish_Combo_01 1504 0.31 0.36 0.30 176 XMSubMetaSxObfu_02 1401 0.27 0.21 0.28 177 XMLngstWrd_03 1358 0.27 0.29 0.27 178 XMBdyGiftCard01 1332 0.87 3.24 0.27 179 FORGED_GMAIL_RCVD 1320 0.96 3.69 0.26 180 XM_H_PHPMailer 1302 0.37 0.78 0.26 181 TR_MSPIKEBAYES00 1299 0.21 0.03 0.26 182 XMSubMetaI_00 1275 0.38 0.88 0.26 183 SpammyFromTLD_01 1253 1.52 6.47 0.25 184 XM_Walgreens_Forge 1185 0.22 0.13 0.24 185 XMPhish30 1127 0.37 0.91 0.23 186 T_XMHurry_00 1125 0.90 3.52 0.23 187 XM_B_COPY_HTML 1120 0.31 0.66 0.22 188 TR_XM_PHPDW 1106 0.50 1.60 0.22 189 XMLngstWrd_04 1098 0.22 0.21 0.22 190 XMOemUri 1086 0.25 0.37 0.22 191 MPART_ALT_DIFF_COUNT 1042 0.27 0.53 0.21 192 DATE_IN_PAST_06_12 1032 0.27 0.54 0.21 193 FILL_THIS_FORM 1032 0.57 1.98 0.21 194 XMBody_29 1022 0.25 0.44 0.20 195 XMNoVowels 1002 0.23 0.37 0.20 196 T_HTML_TAG_BALANCE_CENTER 980 0.29 0.68 0.20 197 XMSolicitRefs_0 968 0.26 0.53 0.19 198 XMCapTrack 967 0.19 0.16 0.19 199 TR_XM_Spammywords 937 0.25 0.50 0.19 200 XM_S_SpammyWords 937 0.25 0.50 0.19 ----------------------------------------------------------------------